Cyber Threat Intelligence by Martin Lee is an informational cyber threat intelligence primer explaining the fundamentals and providing plenty of examples of cyberattacks and threat intelligence. It doesn’t go very deep into CTI, but that doesn’t seem to be its purpose; it’s intended as an intro to the discipline. Lee…

Deep Dive: Exploring the Real-World Value of Open Source Intelligence by Rae Baker is a useful guide to a wide variety of OSINT techniques. It covers the intelligence cycle and OPSEC, and OSINT related to people, social media, businesses and organizations, transportation, critical infrastructure and industrial controls, finance, cryptocurrency, and…

If you spend any time in the intelligence community (IC), whether traditional intel (government/military) or cyber intel, you’ll run across various intelligence-gathering disciplines. They’re usually spelled in all caps and end with INT for intelligence. Below is a quick reference. Some of these disciplines overlap. If you know of any…

The name Clop (often stylized Cl0p) refers to both Ransomware-as-a-Service (RaaS) and the ransomware and extortion threat group that develops and markets the malware (sometimes called the Clop gang or Clop group). It started in 2019 and has become one of the most commonly used forms of ransomware, and has…

Censys is a search engine for Internet-connected hosts and certificates. It’s similar to Shodan. It’s a useful resource for OSINT and CTI. Censys sells paid accounts, but you can also register for a free non-commercial account, which is limited to 250 queries/month. …

Pulsedive is a cyber threat intelligence platform (TIP) with many free features. It includes millions of IP addresses, URLs, and domains, and links them to related malware, threat groups, and reports. It ingests data from 30 sources. Pulsedive Tour If you don’t like the default dark theme, click Account > Change Theme…

Keeping software updated is one of the most important ways to keep systems secure, because updates often include security improvements. On a Mac (like many other systems), many apps check for software updates, but only when they’re opened. If you have apps you don’t open often, they may not be…

If someone stole your phone, would you wish you had more or less personal data stored on it? If a company you use suffered a data breach, would you wish they stored more or less of your personal data? As the amount of data about us has increased, so have…

Infostealers (aka info stealers, info-stealers, information stealers, and stealers) are malware that exfiltrate data, especially credentials, from compromised devices. They’re available as malware-as-a-service (MaaS) on dark web markets for as little as $50–300/month, enabling unsophisticated threat actors to deploy them. What Infostealers Steal Infostealers steal usernames, passwords, names, email addresses, phone numbers, physical…