Threat Research
Collaborative research investigating adversary operations, reversing malware, and tracking threat infrastructure.
Threat Research
Three exposed operator workspaces reveal confirmed access to Russian and Kyrgyz government systems, a Syrian Customs C2 inventory, stolen data and wider targeting of Russian sta...
Threat Research
Tracing The Gentlemen ransomware group's origins, infrastructure, OPSEC failures, organisational structure, and alleged leader.
Threat Research
Exposed operator tooling shows an INC affiliate using likely LLM-generated scripts to enumerate, pivot, and deploy ransomware against network storage
Threat Research
OSINT analysis of Denis Obrezko & the Void Blizzard threat group
Threat Research
FancyBear's OPSEC failure gives Ctrl-Alt-Intel rare visibility inside Russian espionage operations
Threat Research
MuddyWater espionage campaign exposed
Threat Research
OSINT analysis of entities potentially linked to the 'Global Profit' PHaaS platform
Threat Research
Chinese threat actor targets Vietnemse universities in extensive campaign.
Threat Research
Sucessive OPSEC failures expose a Qilin affiliate targeting network appliances for initial access
Threat Research
Open-directories exposes mass exploitation of web-applications globally
Threat Research
Exposed C2 server highlights opportunistic exploitation of CVE-2026-41940 and novel exploitation chains against South-East Asian military & hosting providers
Threat Research
A full technical teardown of FUD Crypt (Cryptor-as-a-Service) and surrounding activity performed by this threat actor
Threat Research
How an exposed C2 exposed the back-end of a cybercrime operation, including threat actors beefing. TGI Fridays was one of the many victims.
Threat Research
Linking TP-Link and ASUS exploitation to a March supply-chain attack, and examining possible overlap with TeamPCP.
Threat Research
Lessons in OPSEC from a sloppy RaaS
Threat Research
A suspected DPRK-associated actor compromises crypto orgs, pillaging cloud environments, stealing proprietary exchange software and source code.
Threat Research
Reconstructing the complete kill-chain of the BuddyBoss Attack
Threat Research
How Claude infiltrated the supply-chain, compromising 200+ websites for fraud
Threat Research
Threat actor deploys Sliver C2 to FortiWeb appliances
Threat Research
An exposed operator panel revealed how Aeternum Loader abuses Polygon smart contracts for C2, allowing us to view all C2 commands ever sent.
Threat Research
Our attempt at reversing Aeternum Loader to extract contract addresses and reveal functionality.
Threat Research
Investigating vulnerabilities in the ErrTraffic panel
Threat Research
Suspected state-affiliated actor targets Afghan and Kazakh entities
Threat Research
An analysis of the threats surrounding exploitation of CVE-2025-55182
Threat Research
Scanning CVE-2025-55182 for the greater good
Threat Research
Analysis of a fully-featured AiTM phishing platform with a collective intelligence & licensing system
Short-form analysis
