Sign in

Sources & Methods

@sourcesmethods.com
78 followers 64 following 20 posts

Blog and monthly digest of Cyber Threat Intelligence (CTI) information sources, tools, articles, events, and helpful tips sourcesmethods.com by @mattreduce.com

PostsRepliesMedia
Reposted by Sources & Methods
SLEUTHCON @sleuthcon.bsky.social · 02/06/2026
Can't make it to Arlington, VA this week for SLEUTHCON? Halcyon has you covered. They're sponsoring our virtual stream so the full experience reaches everyone, wherever you're watching from! Grab your virtual ticket & you can still get our awesome swag (U.S. registrants only). www.sleuthcon.com
042
Reposted by Sources & Methods
The Vertex Project @vertexproject.bsky.social · 28/05/2026
This episode explores representation in CTI, the impact of women leaders at Mandiant, and why diverse perspectives lead to better intelligence analysis. Really thoughtful conversation from the team. Listen here: www.youtube.com/watch?v=Aqqj... #ThreatIntelligence #WomenInCybersecurity
0115
Reposted by Sources & Methods
Socket @socket.dev · 12/05/2026
🚨 UPDATE: Mini Shai-Hulud has crossed from @npmjs.bsky.social into @pypi.org and is still spreading. Newly confirmed compromised artifacts: @​opensearch-project/opensearch: 3.5.3, 3.6.2, 3.7.0, 3.8.0 (1.3M weekly downloads) mistralai: 2.4.6 on PyPI guardrails-ai: 0.10.1 on PyPI
2247
Reposted by Sources & Methods
Matthew Conway @mattreduce.com · 10/05/2026
Excited to speak later this month about applying Analysis of Competing Hypotheses to attribution, using KIM ("APT Down", Phrack issue 72) as a case study 🔍 secnerdssf.com/thecon
secnerdssf.com
thecon — Sec Nerds
041
Reposted by Sources & Methods
Bellingcat @bellingcat.com · 08/12/2025
Our monthly open source challenges just got an upgrade... With hidden codes - a corrupted archive and a mysterious figure pulling the strings. Get started at challenge.bellingcat.com
17513
Reposted by Sources & Methods
The Vertex Project @vertexproject.bsky.social · 08/12/2025
We recently released the Synapse @Feedly Power-Up! Ingest Feedly TI API feeds into Synapse, model articles as media:news, link indicators, and automate daily/hourly pulls to speed up reporting + enrichment. Learn more: synapse.docs.vertex.link/projects/rap...
053
Sources & Methods @sourcesmethods.com · 05/12/2025
What are they up to at Matt's in the Market in Seattle? 👀
A sign above a bar reads "Counter Intelligence"
031
Reposted by Sources & Methods
James Kettle @jameskettle.com · 04/12/2025
You can now scan for #react2shell in Burp Suite! To enable, install the Extensibility Helper bapp, go to the bambda tab and search for react2shell. Shout-out to Assetnote for sharing a quality detection technique!
0153
Sources & Methods @sourcesmethods.com · 05/12/2025
China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) #React2Shell aws.amazon.com/blogs/securi...
aws.amazon.com
China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) | Amazon Web Services
Within hours of the public disclosure of CVE-2025-55182 (React2Shell) on December 3, 2025, Amazon threat intelligence teams observed active exploitation attempts by multiple China state-nexus threat g...
100
Reposted by Sources & Methods
Dominic White @singe.bsky.social · 20/11/2025
Made this last night, it’s useful for finding a large number of domains hosting phishing kits or malware based on a consistent pattern github.com/singe/domain-p… Might be useful for some of you.
github.com
GitHub - singe/domain-probe: A utility to find identically configured domains and web-servers based on a pattern. Used to find phishing kits.
A utility to find identically configured domains and web-servers based on a pattern. Used to find phishing kits. - singe/domain-probe
064
Sources & Methods @sourcesmethods.com · 19/11/2025
If the talks at @cyberwarcon.bsky.social today are any indication, while you may think threat actor adoption of generative AI improves sophistication and eliminates telling mistakes in phishing and info ops, that future is not evenly distributed!
053
Reposted by Sources & Methods
Greg Otto @gregotto.bsky.social · 19/11/2025
Ah @cyberwarcon.bsky.social the only conference for intel ops research authored by the terminally online
37313
Reposted by Sources & Methods
Allan “Ransomware Sommelier” Liska @ransomwaresommelier.com · 19/11/2025
It’s rare that we see an actual NEW ransomware family, so it will be interesting to see how this develops. via @lawrenceabrams.bsky.social & @bleepingcomputer.com
bleepingcomputer.com
Meet ShinySp1d3r: New Ransomware-as-a-Service created by ShinyHunters
An in-development build of the upcoming ShinySp1d3r ransomware-as-a-service platform has surfaced, offering a preview of the upcoming extortion operation.
173
Reposted by Sources & Methods
GreyNoise @greynoise.io · 19/11/2025
Attackers move fast, so your blocklists should too. GreyNoise now lets you convert any query into a real-time blocklist that updates automatically as attacker infrastructure changes. Start using it today on the GreyNoise platform.
greynoise.io
Introducing Query-Based Blocklists: Fully Configurable, Real-Time Threat Blocking in the GreyNoise Platform
GreyNoise customers can turn any GreyNoise query in the platform directly into a real-time blocklist for their firewall, SOAR, or other enforcement points.
031
Sources & Methods @sourcesmethods.com · 19/11/2025
Great talk by @pylos.co on possible futures for Volt Typhoon and why the cluster's strategic goal means the activity will evolve and at times be disrupted but not stop any time soon
033
Sources & Methods @sourcesmethods.com · 19/11/2025
Now I can say I've seen a DPRK IT Worker (recorded) on a video call, thanks to Caleb Marquis and Eric Kerr! Next up is @pylos.co on Volt Typhoon.
121
Sources & Methods @sourcesmethods.com · 19/11/2025
Kicked off @cyberwarcon.bsky.social with @dmitri.silverado.org apologizing for 15yrs of threat actor naming chaos and proposing a new scheme, and plenty of Russia-related content (with top-tier memes)
021
Sources & Methods @sourcesmethods.com · 19/11/2025
Good morning, @cyberwarcon.bsky.social! ☕️
041
Reposted by Sources & Methods
Andrew Morris @andrewmorr.is · 18/11/2025
We've hired Colonel Shawn Smagh to up our @greynoise.io intel reporting game and we've started producing weekly intelligence briefs. This week's is a banger.
082
Reposted by Sources & Methods
visi stark @invisig0th.bsky.social · 18/11/2025
Game on! The @cyberwarcon.bsky.social Synapse challenge is live! 💚💚💚
0101
Reposted by Sources & Methods
BSides Pyongyang @bsidespyongyang.bsky.social · 18/11/2025
Coming up at 12:40 EST for #IanGillespie presenting "From Memecoins to Missiles: How North Korea Launders Stolen Crypto into Real World Riches" #BSidesPyongyang25 #BSPY25 www.twitch.tv/bsidespyongyang www.youtube.com/@BSidesPyongyang
011
Sources & Methods @sourcesmethods.com · 18/11/2025
Watching @bsidespyongyang.bsky.social on the way to @cyberwarcon.bsky.social twitch.tv/BSidesPyongy...
m.twitch.tv
BSidesPyongyang - Twitch
BSides Pyongyang 2025
001
Reposted by Sources & Methods
SpecterOps @specterops.io · 12/11/2025
Have questions about submitting to the #SOCON2026 CFP? We’ve got answers. The CFP closes soon — submit your proposal by Nov 15 to participate in the only conference dedicated to advancing Attack Path Management. 📝 Submit: ghst.ly/socon26-cfp
111
Reposted by Sources & Methods
Obsidian @obsidian.md · 12/11/2025
Obsidian Importer now lets you generate Markdown files from a CSV. It converts thousands records in seconds and automatically generates a Base that you can use to explore and edit the data.
915518
Reposted by Sources & Methods
🎃👻BOO👻🎃rritosec @unauthorized.computer · 10/11/2025
cloud.google.com/blog/topics/... google cloud / mandiant blogged about a cool investigation that I got to pitch in on & had a small verse to contribute in the broader context of it. these are the things that remind me how much I enjoy what I do.
cloud.google.com
Unauthenticated Remote Access via Triofox Vulnerability CVE-2025-12480 | Google Cloud Blog
An unauthenticated access vulnerability in Gladinet's Triofox platform, exploited by the threat actor UNC6485.
041
Reposted by Sources & Methods
MITRE ATT&CK @attack.mitre.org · 07/11/2025
It was recorded, and slides are now being shared.... Slides and videos from ATT&CKcon 6.0 are now posted in an easy to find way. Check out attack.mitre.org/resources/at... to check out our great talks (and Couch Talks) from October, or even check out past ATT&CKcons from that same page.
attack.mitre.org
MITRE ATT&CKcon - ATT&CKcon 6.0 | MITRE ATT&CK®
075
Reposted by Sources & Methods
Jamie Levy 🦉 @gleeda.bsky.social · 07/11/2025
There's an open role for a Staff CTI Analyst on my team here @huntress.com 📢💫 ✨Do you love doing correlations between different incidents, sometimes digging into them, or doing malware analysis? ✨Do you like doing data analysis, and using this to make threat reports? 👇
175
Reposted by Sources & Methods
38 North @38north.org · 09/10/2025
"The DPRK IT worker threat is more than a fraud or sanctions evasion issue; it exposes systemic weaknesses in how identity is verified and managed across the global economy." Chandana Seshadri looks at DPRK IT worker typologies & identifies a path forward.
bit.ly
The Global Threat of DPRK IT Workers - 38 North: Informed Analysis of North Korea
The Democratic People’s Republic of Korea’s (North Korea or DPRK) is most often associated with ...
041
Reposted by Sources & Methods
Bellingcat @bellingcat.com · 24/09/2025
Our new and improved Bellingcat Toolkit is one-year-old today! If you haven't used it yet its a one-stop shop for discovering useful open source tools, maintained by an amazing group of volunteers. You can find use cases, guidance and honest reviews for each tool. bellingcat.gitbook.io/toolkit
bellingcat.gitbook.io
Home | Bellingcat's Online Investigation Toolkit
A toolkit for open source researchers
515070
Reposted by Sources & Methods
John Hultquist @hultquist.bsky.social · 24/09/2025
We are releasing details on BRICKSTORM malware activity, a China-based threat hitting US tech to potentially target downstream customers and hunt for data on vulnerabilities in products. This actor is stealthy, and we've provided a tool to hunt for them. cloud.google.com/blog/topics/...
cloud.google.com
Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors | Google Cloud Blog
BRICKSTORM is a stealthy backdoor used by suspected China-nexus actors for long-term espionage.
02113
Reposted by Sources & Methods
The Banshee Queen 👑 @cyberoverdrive.bsky.social · 24/09/2025
First public report at Recorded Future by yours truly is out! RedNovember (formerly TAG-100, a.k.a. Storm-2077) is a Chinese state-sponsored threat group focused on intelligence collection, especially on flashpoint issues of strategic interest to China. www.recordedfuture.com/research/red...
recordedfuture.com
RedNovember Targets Government, Defense, and Technology Organizations
RedNovember, a likely Chinese state-sponsored cyber-espionage group, has targeted global government, defense, and tech sectors using advanced tools like Pantegana and Cobalt Strike. Discover the lates...
22414
Reposted by Sources & Methods
CYBERWARCON @cyberwarcon.bsky.social · 23/09/2025
CFP closes this Friday, September 26th at 11:59pm EST! If you'd like to speak at CYBERWARCON this year, get your talk submission in ASAP to be considered! Submit your talk here >> www.cyberwarcon.com/cfp2025 #CYBERWARCON #CFP
0149
Reposted by Sources & Methods
Bellingcat @bellingcat.com · 21/09/2025
It is a good time to learn how to find accurate information online. We’re offering virtual training sessions over the month of October, teaching you Bellingcat’s investigative techniques…
4340122
Reposted by Sources & Methods
Margi Murphy @margimurphy.bsky.social · 19/09/2025
For more than a year I’ve spoken with Scattered Spider “caller” Noah Urban from a Florida jail. I wanted to know how they chose victims, their methods and how Noah became entangled in a virtually and physically violent world. We’re publishing his story today: www.bloomberg.com/news/feature...
bloomberg.com
‘I Was a Weird Kid’: Jailhouse Confessions of a Teen Hacker
Noah Urban’s role in the notorious Scattered Spider gang was talking people into unwittingly giving criminals access to sensitive computer systems.
33515
Reposted by Sources & Methods
SentinelLABS @sentinellabs.bsky.social · 19/09/2025
🔥🔥 Fresh research drop live from #labscon Arizona. @alex.leetnoob.com and @morecoffeeplz.bsky.social with @vkamluk.bsky.social The Hunt for LLM-enabled malware #ai #cyber #threatintel s1.ai/llm-mw
s1.ai
Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware
LLM-enabled malware poses new challenges for detection. SentinelLABS presents groundbreaking research on how to hunt for this new class of threats.
043
Reposted by Sources & Methods
GreyNoise @greynoise.io · 15/09/2025
We're looking for some awesome folks to join our team! If one of these roles catches your eye, we'd love to hear from you. 👩‍💻 greynoise.io/careers
We are hiring

Senior Software Engineer 
Head of US Federal Sales
RSM - US DoD + IC
RSM - US Enterprise
Sales Engineer - US DoD + IC

Apply now at greynoise.io/careers
043
Reposted by Sources & Methods
The Vertex Project @vertexproject.bsky.social · 15/09/2025
If you couldn't attend PIVOTcon live, our Threat Clustering Workshop is now available on the Vertex Intel-Sharing Synapse Instance! Examine real-world data and answer the age-old question: “Is this a cluster? Or a CLUSTER!?” Learn more here: vertex.link/blogs/threat...
vertex.link
Here at The Vertex Project, we spend a lot of time thinking about how we can make Synapse (and analysis in general) better. For example, on any given day, we might ask ourselves:
063
Reposted by Sources & Methods
Nicole Hoffman @threathuntergirl.bsky.social · 05/09/2025
Three things I wish I knew before starting in CTI: 1. You are going to repeat yourself a lot, and that is normal. You may often find yourself saying “remember I told you about this weeks ago.” It is easy to get frustrated when nobody reads your report, but repetition is part of the job.
182
Reposted by Sources & Methods
Mick Baccio @nohackme.thruntcon.com · 04/09/2025
submit
161
Reposted by Sources & Methods
Tom Hegel @hegel.bsky.social · 04/09/2025
New research from @milenkowski.bsky.social (S1) and @kennethkinion.bsky.social (Validin): 🇰🇵 Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms Research: www.sentinelone.com/labs/contagi... Reuters story: www.reuters.com/world/asia-p...
sentinelone.com
Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms
DPRK-aligned threat actors abuse CTI platforms to detect infrastructure exposure and scout for new assets.
075
Reposted by Sources & Methods
Pasquale Stirparo 🇺🇦 🇪🇺 @pstirparo.bsky.social · 28/08/2025
TL;DR I am launching my #startup and we are going to change how to evaluate,cluster and reason about #malware, delivering accurate,contextual intelligence on samples. Say Hi to RationalEdge @rationaledge.bsky.social rationaledge.io #threatintel #threathunting #cti #reverseengineering #detection 1/9
rationaledge.io
RationalEdge - Intelligence Meets Accuracy
Advanced malware analysis and threat intelligence solutions by RationalEdge
22514
Reposted by Sources & Methods
Greg Lesnewich @greg-l.bsky.social · 28/08/2025
an important, and often overlooked skill in threat intel, is being funny
3263
Reposted by Sources & Methods
CYBERWARCON @cyberwarcon.bsky.social · 28/08/2025
CYBERWARCON is coming!!! Registration and CFP are now open for this year's #CYBERWARCON! This year's keynote speaker will be @dmitri.silverado.org!! We are back in Arlington, VA this year on November 19th. www.cyberwarcon.com
cyberwarcon.com
CYBERWARCON
12822
Reposted by Sources & Methods
CYBERWARCON @cyberwarcon.bsky.social · 18/08/2025
CYBERWARCON is back. 🗓️ Wednesday, Nov 19, 2025 | Crystal City + virtual 🔗 cyberwarcon.com
1125
Sources & Methods @sourcesmethods.com · 23/08/2025
Sources & Methods #CTI newsletter issue 25 is out with more articles, tools, and conferences for you 📨 sourcesmethods.com/sources-meth...
sourcesmethods.com
Sources & Methods Newsletter #25 - August 2025
Hello again! I'm glad to share this month that I joined Remitly to help build their Threat Intelligence program, ensuring the safety and security of a vital financial service for millions around the w...
011
Reposted by Sources & Methods
Organized Crime and Corruption Reporting Project @occrp.org · 30/07/2025
Less than 3 hours left until our OCCRP Briefing | New Sanctions Evasion Playbook. Don't forget to sign up to join us2.campaign-archive.com?u=8a7b7dd3a0...
076
Reposted by Sources & Methods
J. A. Guerrero-Saade (JAGS) @jags.bsky.social · 10/05/2025
We should use Clue (1986) to explain Analysis of Competing Hypotheses to incoming analysts.
052
Reposted by Sources & Methods
Bellingcat @bellingcat.com · 26/07/2025
Want to learn what goes into finding stolen art? On Thursday at 5pm CEST /11am EDT we'll be joined by @artdetective.bsky.social , the citizen art detective behind the recovery of over 200 pieces of art including lost Picasso, Van Gogh and Dali works. Join us live for Q&A discord.gg/2fMCucQ5?eve...
Bellingcat Stage Talk, Thursday 31/07, 5pm CEST/11am EDT Discord.com/invite/bellingcat , Detecting Stolen Art with Art Detective Arthur Brand
511937
Reposted by Sources & Methods
Aryeh Goretsky @goretsky.bsky.social · 26/07/2025
As I watched infostealers encounters rise I wrote this guide for @esetresearch.bsky.social on the recovery process: www.welivesecurity.com/en/cybersecu...
welivesecurity.com
My information was stolen. Now what?
Follow these steps to reduce the odds of having your personal information stolen, or recover more quickly in the event that you have fallen victim to an information stealer attack.
053
Reposted by Sources & Methods
andy jabbour @andyjabbour.bsky.social · 23/07/2025
There can be real costs for #ransomware. 'Alpha Medical Centre has been the victim of a serious cybersecurity attack. As a result of this criminal act and its devastating impact, we have no choice but to close the practice.' databreaches.net/2025/07/22/t... #cybersecurity @gate15.bsky.social
databreaches.net
Two more entities have folded after ransomware attacks – DataBreaches.Net
012