Reposted by Sources & MethodsSLEUTHCON @sleuthcon.bsky.social · 02/06/2026Can't make it to Arlington, VA this week for SLEUTHCON? Halcyon has you covered. They're sponsoring our virtual stream so the full experience reaches everyone, wherever you're watching from! Grab your virtual ticket & you can still get our awesome swag (U.S. registrants only). www.sleuthcon.com 042
Reposted by Sources & MethodsThe Vertex Project @vertexproject.bsky.social · 28/05/2026This episode explores representation in CTI, the impact of women leaders at Mandiant, and why diverse perspectives lead to better intelligence analysis. Really thoughtful conversation from the team. Listen here: www.youtube.com/watch?v=Aqqj... #ThreatIntelligence #WomenInCybersecurity 0115
Reposted by Sources & MethodsSocket @socket.dev · 12/05/2026🚨 UPDATE: Mini Shai-Hulud has crossed from @npmjs.bsky.social into @pypi.org and is still spreading. Newly confirmed compromised artifacts: @opensearch-project/opensearch: 3.5.3, 3.6.2, 3.7.0, 3.8.0 (1.3M weekly downloads) mistralai: 2.4.6 on PyPI guardrails-ai: 0.10.1 on PyPI 2247
Reposted by Sources & MethodsMatthew Conway @mattreduce.com · 10/05/2026Excited to speak later this month about applying Analysis of Competing Hypotheses to attribution, using KIM ("APT Down", Phrack issue 72) as a case study 🔍 secnerdssf.com/theconsecnerdssf.comthecon — Sec Nerds 041
Reposted by Sources & MethodsBellingcat @bellingcat.com · 08/12/2025Our monthly open source challenges just got an upgrade... With hidden codes - a corrupted archive and a mysterious figure pulling the strings. Get started at challenge.bellingcat.com 17513
Reposted by Sources & MethodsThe Vertex Project @vertexproject.bsky.social · 08/12/2025We recently released the Synapse @Feedly Power-Up! Ingest Feedly TI API feeds into Synapse, model articles as media:news, link indicators, and automate daily/hourly pulls to speed up reporting + enrichment. Learn more: synapse.docs.vertex.link/projects/rap... 053
Sources & Methods @sourcesmethods.com · 05/12/2025What are they up to at Matt's in the Market in Seattle? 👀 031
Reposted by Sources & MethodsJames Kettle @jameskettle.com · 04/12/2025You can now scan for #react2shell in Burp Suite! To enable, install the Extensibility Helper bapp, go to the bambda tab and search for react2shell. Shout-out to Assetnote for sharing a quality detection technique! 0153
Sources & Methods @sourcesmethods.com · 05/12/2025China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) #React2Shell aws.amazon.com/blogs/securi...aws.amazon.comChina-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) | Amazon Web ServicesWithin hours of the public disclosure of CVE-2025-55182 (React2Shell) on December 3, 2025, Amazon threat intelligence teams observed active exploitation attempts by multiple China state-nexus threat g... 100
Reposted by Sources & MethodsDominic White @singe.bsky.social · 20/11/2025Made this last night, it’s useful for finding a large number of domains hosting phishing kits or malware based on a consistent pattern github.com/singe/domain-p… Might be useful for some of you.github.comGitHub - singe/domain-probe: A utility to find identically configured domains and web-servers based on a pattern. Used to find phishing kits.A utility to find identically configured domains and web-servers based on a pattern. Used to find phishing kits. - singe/domain-probe 064
Sources & Methods @sourcesmethods.com · 19/11/2025If the talks at @cyberwarcon.bsky.social today are any indication, while you may think threat actor adoption of generative AI improves sophistication and eliminates telling mistakes in phishing and info ops, that future is not evenly distributed! 053
Reposted by Sources & MethodsGreg Otto @gregotto.bsky.social · 19/11/2025Ah @cyberwarcon.bsky.social the only conference for intel ops research authored by the terminally online 37313
Reposted by Sources & MethodsAllan “Ransomware Sommelier” Liska @ransomwaresommelier.com · 19/11/2025It’s rare that we see an actual NEW ransomware family, so it will be interesting to see how this develops. via @lawrenceabrams.bsky.social & @bleepingcomputer.combleepingcomputer.comMeet ShinySp1d3r: New Ransomware-as-a-Service created by ShinyHuntersAn in-development build of the upcoming ShinySp1d3r ransomware-as-a-service platform has surfaced, offering a preview of the upcoming extortion operation. 173
Reposted by Sources & MethodsGreyNoise @greynoise.io · 19/11/2025Attackers move fast, so your blocklists should too. GreyNoise now lets you convert any query into a real-time blocklist that updates automatically as attacker infrastructure changes. Start using it today on the GreyNoise platform.greynoise.ioIntroducing Query-Based Blocklists: Fully Configurable, Real-Time Threat Blocking in the GreyNoise PlatformGreyNoise customers can turn any GreyNoise query in the platform directly into a real-time blocklist for their firewall, SOAR, or other enforcement points. 031
Sources & Methods @sourcesmethods.com · 19/11/2025Great talk by @pylos.co on possible futures for Volt Typhoon and why the cluster's strategic goal means the activity will evolve and at times be disrupted but not stop any time soon 033
Sources & Methods @sourcesmethods.com · 19/11/2025Now I can say I've seen a DPRK IT Worker (recorded) on a video call, thanks to Caleb Marquis and Eric Kerr! Next up is @pylos.co on Volt Typhoon. 121
Sources & Methods @sourcesmethods.com · 19/11/2025Kicked off @cyberwarcon.bsky.social with @dmitri.silverado.org apologizing for 15yrs of threat actor naming chaos and proposing a new scheme, and plenty of Russia-related content (with top-tier memes) 021
Reposted by Sources & MethodsAndrew Morris @andrewmorr.is · 18/11/2025We've hired Colonel Shawn Smagh to up our @greynoise.io intel reporting game and we've started producing weekly intelligence briefs. This week's is a banger. 082
Reposted by Sources & Methodsvisi stark @invisig0th.bsky.social · 18/11/2025Game on! The @cyberwarcon.bsky.social Synapse challenge is live! 💚💚💚 0101
Reposted by Sources & MethodsBSides Pyongyang @bsidespyongyang.bsky.social · 18/11/2025Coming up at 12:40 EST for #IanGillespie presenting "From Memecoins to Missiles: How North Korea Launders Stolen Crypto into Real World Riches" #BSidesPyongyang25 #BSPY25 www.twitch.tv/bsidespyongyang www.youtube.com/@BSidesPyongyang 011
Sources & Methods @sourcesmethods.com · 18/11/2025Watching @bsidespyongyang.bsky.social on the way to @cyberwarcon.bsky.social twitch.tv/BSidesPyongy...m.twitch.tvBSidesPyongyang - TwitchBSides Pyongyang 2025 001
Reposted by Sources & MethodsSpecterOps @specterops.io · 12/11/2025Have questions about submitting to the #SOCON2026 CFP? We’ve got answers. The CFP closes soon — submit your proposal by Nov 15 to participate in the only conference dedicated to advancing Attack Path Management. 📝 Submit: ghst.ly/socon26-cfp 111
Reposted by Sources & MethodsObsidian @obsidian.md · 12/11/2025Obsidian Importer now lets you generate Markdown files from a CSV. It converts thousands records in seconds and automatically generates a Base that you can use to explore and edit the data. 915518
Reposted by Sources & Methods🎃👻BOO👻🎃rritosec @unauthorized.computer · 10/11/2025cloud.google.com/blog/topics/... google cloud / mandiant blogged about a cool investigation that I got to pitch in on & had a small verse to contribute in the broader context of it. these are the things that remind me how much I enjoy what I do.cloud.google.comUnauthenticated Remote Access via Triofox Vulnerability CVE-2025-12480 | Google Cloud BlogAn unauthenticated access vulnerability in Gladinet's Triofox platform, exploited by the threat actor UNC6485. 041
Reposted by Sources & MethodsMITRE ATT&CK @attack.mitre.org · 07/11/2025It was recorded, and slides are now being shared.... Slides and videos from ATT&CKcon 6.0 are now posted in an easy to find way. Check out attack.mitre.org/resources/at... to check out our great talks (and Couch Talks) from October, or even check out past ATT&CKcons from that same page.attack.mitre.orgMITRE ATT&CKcon - ATT&CKcon 6.0 | MITRE ATT&CK® 075
Reposted by Sources & MethodsJamie Levy 🦉 @gleeda.bsky.social · 07/11/2025There's an open role for a Staff CTI Analyst on my team here @huntress.com 📢💫 ✨Do you love doing correlations between different incidents, sometimes digging into them, or doing malware analysis? ✨Do you like doing data analysis, and using this to make threat reports? 👇 175
Reposted by Sources & Methods38 North @38north.org · 09/10/2025"The DPRK IT worker threat is more than a fraud or sanctions evasion issue; it exposes systemic weaknesses in how identity is verified and managed across the global economy." Chandana Seshadri looks at DPRK IT worker typologies & identifies a path forward.bit.lyThe Global Threat of DPRK IT Workers - 38 North: Informed Analysis of North KoreaThe Democratic People’s Republic of Korea’s (North Korea or DPRK) is most often associated with ... 041
Reposted by Sources & MethodsBellingcat @bellingcat.com · 24/09/2025Our new and improved Bellingcat Toolkit is one-year-old today! If you haven't used it yet its a one-stop shop for discovering useful open source tools, maintained by an amazing group of volunteers. You can find use cases, guidance and honest reviews for each tool. bellingcat.gitbook.io/toolkitbellingcat.gitbook.ioHome | Bellingcat's Online Investigation ToolkitA toolkit for open source researchers 515070
Reposted by Sources & MethodsJohn Hultquist @hultquist.bsky.social · 24/09/2025We are releasing details on BRICKSTORM malware activity, a China-based threat hitting US tech to potentially target downstream customers and hunt for data on vulnerabilities in products. This actor is stealthy, and we've provided a tool to hunt for them. cloud.google.com/blog/topics/...cloud.google.comAnother BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors | Google Cloud BlogBRICKSTORM is a stealthy backdoor used by suspected China-nexus actors for long-term espionage. 02113
Reposted by Sources & MethodsThe Banshee Queen 👑 @cyberoverdrive.bsky.social · 24/09/2025First public report at Recorded Future by yours truly is out! RedNovember (formerly TAG-100, a.k.a. Storm-2077) is a Chinese state-sponsored threat group focused on intelligence collection, especially on flashpoint issues of strategic interest to China. www.recordedfuture.com/research/red...recordedfuture.comRedNovember Targets Government, Defense, and Technology OrganizationsRedNovember, a likely Chinese state-sponsored cyber-espionage group, has targeted global government, defense, and tech sectors using advanced tools like Pantegana and Cobalt Strike. Discover the lates... 22414
Reposted by Sources & MethodsCYBERWARCON @cyberwarcon.bsky.social · 23/09/2025CFP closes this Friday, September 26th at 11:59pm EST! If you'd like to speak at CYBERWARCON this year, get your talk submission in ASAP to be considered! Submit your talk here >> www.cyberwarcon.com/cfp2025 #CYBERWARCON #CFP 0149
Reposted by Sources & MethodsBellingcat @bellingcat.com · 21/09/2025It is a good time to learn how to find accurate information online. We’re offering virtual training sessions over the month of October, teaching you Bellingcat’s investigative techniques… 4340122
Reposted by Sources & MethodsMargi Murphy @margimurphy.bsky.social · 19/09/2025For more than a year I’ve spoken with Scattered Spider “caller” Noah Urban from a Florida jail. I wanted to know how they chose victims, their methods and how Noah became entangled in a virtually and physically violent world. We’re publishing his story today: www.bloomberg.com/news/feature...bloomberg.com‘I Was a Weird Kid’: Jailhouse Confessions of a Teen HackerNoah Urban’s role in the notorious Scattered Spider gang was talking people into unwittingly giving criminals access to sensitive computer systems. 33515
Reposted by Sources & MethodsSentinelLABS @sentinellabs.bsky.social · 19/09/2025🔥🔥 Fresh research drop live from #labscon Arizona. @alex.leetnoob.com and @morecoffeeplz.bsky.social with @vkamluk.bsky.social The Hunt for LLM-enabled malware #ai #cyber #threatintel s1.ai/llm-mws1.aiPrompts as Code & Embedded Keys | The Hunt for LLM-Enabled MalwareLLM-enabled malware poses new challenges for detection. SentinelLABS presents groundbreaking research on how to hunt for this new class of threats. 043
Reposted by Sources & MethodsGreyNoise @greynoise.io · 15/09/2025We're looking for some awesome folks to join our team! If one of these roles catches your eye, we'd love to hear from you. 👩💻 greynoise.io/careers 043
Reposted by Sources & MethodsThe Vertex Project @vertexproject.bsky.social · 15/09/2025If you couldn't attend PIVOTcon live, our Threat Clustering Workshop is now available on the Vertex Intel-Sharing Synapse Instance! Examine real-world data and answer the age-old question: “Is this a cluster? Or a CLUSTER!?” Learn more here: vertex.link/blogs/threat...vertex.linkHere at The Vertex Project, we spend a lot of time thinking about how we can make Synapse (and analysis in general) better. For example, on any given day, we might ask ourselves: 063
Reposted by Sources & MethodsNicole Hoffman @threathuntergirl.bsky.social · 05/09/2025Three things I wish I knew before starting in CTI: 1. You are going to repeat yourself a lot, and that is normal. You may often find yourself saying “remember I told you about this weeks ago.” It is easy to get frustrated when nobody reads your report, but repetition is part of the job. 182
Reposted by Sources & MethodsTom Hegel @hegel.bsky.social · 04/09/2025New research from @milenkowski.bsky.social (S1) and @kennethkinion.bsky.social (Validin): 🇰🇵 Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms Research: www.sentinelone.com/labs/contagi... Reuters story: www.reuters.com/world/asia-p...sentinelone.comContagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel PlatformsDPRK-aligned threat actors abuse CTI platforms to detect infrastructure exposure and scout for new assets. 075
Reposted by Sources & MethodsPasquale Stirparo 🇺🇦 🇪🇺 @pstirparo.bsky.social · 28/08/2025TL;DR I am launching my #startup and we are going to change how to evaluate,cluster and reason about #malware, delivering accurate,contextual intelligence on samples. Say Hi to RationalEdge @rationaledge.bsky.social rationaledge.io #threatintel #threathunting #cti #reverseengineering #detection 1/9rationaledge.ioRationalEdge - Intelligence Meets AccuracyAdvanced malware analysis and threat intelligence solutions by RationalEdge 22514
Reposted by Sources & MethodsGreg Lesnewich @greg-l.bsky.social · 28/08/2025an important, and often overlooked skill in threat intel, is being funny 3263
Reposted by Sources & MethodsCYBERWARCON @cyberwarcon.bsky.social · 28/08/2025CYBERWARCON is coming!!! Registration and CFP are now open for this year's #CYBERWARCON! This year's keynote speaker will be @dmitri.silverado.org!! We are back in Arlington, VA this year on November 19th. www.cyberwarcon.comcyberwarcon.comCYBERWARCON 12822
Reposted by Sources & MethodsCYBERWARCON @cyberwarcon.bsky.social · 18/08/2025CYBERWARCON is back. 🗓️ Wednesday, Nov 19, 2025 | Crystal City + virtual 🔗 cyberwarcon.com 1125
Sources & Methods @sourcesmethods.com · 23/08/2025Sources & Methods #CTI newsletter issue 25 is out with more articles, tools, and conferences for you 📨 sourcesmethods.com/sources-meth...sourcesmethods.comSources & Methods Newsletter #25 - August 2025Hello again! I'm glad to share this month that I joined Remitly to help build their Threat Intelligence program, ensuring the safety and security of a vital financial service for millions around the w... 011
Reposted by Sources & MethodsOrganized Crime and Corruption Reporting Project @occrp.org · 30/07/2025Less than 3 hours left until our OCCRP Briefing | New Sanctions Evasion Playbook. Don't forget to sign up to join us2.campaign-archive.com?u=8a7b7dd3a0... 076
Reposted by Sources & MethodsJ. A. Guerrero-Saade (JAGS) @jags.bsky.social · 10/05/2025We should use Clue (1986) to explain Analysis of Competing Hypotheses to incoming analysts. 052
Reposted by Sources & MethodsBellingcat @bellingcat.com · 26/07/2025Want to learn what goes into finding stolen art? On Thursday at 5pm CEST /11am EDT we'll be joined by @artdetective.bsky.social , the citizen art detective behind the recovery of over 200 pieces of art including lost Picasso, Van Gogh and Dali works. Join us live for Q&A discord.gg/2fMCucQ5?eve... 511937
Reposted by Sources & MethodsAryeh Goretsky @goretsky.bsky.social · 26/07/2025As I watched infostealers encounters rise I wrote this guide for @esetresearch.bsky.social on the recovery process: www.welivesecurity.com/en/cybersecu...welivesecurity.comMy information was stolen. Now what?Follow these steps to reduce the odds of having your personal information stolen, or recover more quickly in the event that you have fallen victim to an information stealer attack. 053