Cyber threat feeds (or threat data feeds) are regularly-updated sources of data about cyber threats, such as malicious IP addresses, malicious domain names, malicious email addresses, malware hashes, malware file names, and other indicators of compromise (IoCs). Threat data feeds can use various formats, including STIX, CSV, JSON, and text…

I’m often asked who is behind cyberattacks, and why they attack. It’s not a simple answer, because there’s a wide variety of threat actor types and motives. Organizations differ in how they categorize them, but here are the most common. Threat Actor Types & Their Motives Cybercriminals, Organized Crime Criminals are the most common type of threat actor. They’re…

Cyber Threat Intelligence by Martin Lee is an informational cyber threat intelligence primer explaining the fundamentals and providing plenty of examples of cyberattacks and threat intelligence. It doesn’t go very deep into CTI, but that doesn’t seem to be its purpose; it’s intended as an intro to the discipline. Lee…

Deep Dive: Exploring the Real-World Value of Open Source Intelligence by Rae Baker is a useful guide to a wide variety of OSINT techniques. It covers the intelligence cycle and OPSEC, and OSINT related to people, social media, businesses and organizations, transportation, critical infrastructure and industrial controls, finance, cryptocurrency, and…

If you spend any time in the intelligence community (IC), whether traditional intel (government/military) or cyber intel, you’ll run across various intelligence-gathering disciplines. They’re usually spelled in all caps and end with INT for intelligence. Below is a quick reference. Some of these disciplines overlap. If you know of any…

The name Clop (often stylized Cl0p) refers to both Ransomware-as-a-Service (RaaS) and the ransomware and extortion threat group that develops and markets the malware (sometimes called the Clop gang or Clop group). …

Censys is a search engine for Internet-connected hosts and certificates. It’s similar to Shodan. It’s a useful resource for OSINT and CTI. Censys sells paid accounts, but you can also register for a free non-commercial account, which is limited to 250 queries/month. …

Pulsedive is a cyber threat intelligence platform (TIP) with many free features. It includes millions of IP addresses, URLs, and domains, and links them to related malware, threat groups, and reports. It ingests data from 30 sources. Pulsedive Tour If you don’t like the default dark theme, click Account > Change Theme…

Keeping software updated is one of the most important ways to keep systems secure, because updates often include security improvements. On a Mac (like many other systems), many apps check for software updates, but only when they’re opened. If you have apps you don’t open often, they may not be…