r/CTI

I've been tracking the surge in hacktivist activity following India-Pakistan tensions and I just finished my analysis.

https://intelinsights.substack.com/p/profiling-hacktivist-groupsalliances

The majority of groups are rallying around pro-Palestinian/anti-India agendas, with AnonSec serving as a central coordination hub. But here's what caught my attention - follower counts don't always match technical capability.

Most of the groups are running dual operations - cyber attacks alongside psychological warfare. The most concerning aren't necessarily the loudest voices, but those quietly building both technical skil

Hello,

I’m relatively new to Cyber Threat Intelligence (CTI) and have been exploring open-source "free" threat feeds to integrate with Microsoft Sentinel. I've reviewed products such as Shodan, Pulsedive, AlienVault, and others. However, most of them appear to offer free access only for personal or private use, not for business or enterprise environments.

Are there any free threat feeds available for enterprise use?
I fully understand that with open-source or free solutions, the quality and freshness of the data may not match that of paid offerings. However, at this time, there is no available budget to invest $XX,000 into a commercial solution.

Cheers

One week and we should have working servers again under our new host, VenatusHost (venatushost.com). Currently we just have the frontend of the site being worked on but will be setting up multicraft and servers soon. Thanks for being patient guys!

CTI Academy Cyber Threat Intelligence Platform is Online!

On this platform, you can access courses and challenges prepared in the field of Cyber Threat Intelligence.

What awaits you on this platform?

💡 Courses: From beginners to experts, hands-on and close to real scenarios!

🔥 Quizzes and Challenges: Test your knowledge, compete with your rivals and come out on top!

🏆 Certifications: Prove your competencies and make a difference in your career!

Take your place now: https://ctiacademy.io

https://preview.redd.it/vb5uthrbtfbe1.jpg?width=1280&format=pjpg&auto=webp&s=03e8b73c8f41df28e099046b07a2695f27d6ef22

Hi CTI folks, I come from a digital marketing/content background and I’m now pivoting into cybersecurity – particularly Threat Intelligence. I enjoy writing, research, and OSINT. I’m curious:

Are there roles that blend CTI analysis and content creation (like blog writing, threat reports, etc.)?

How do analysts usually share their work or research publicly?

What are some good ways to build credibility as a beginner trying to break in?

Appreciate any leads, examples, or advice. Thanks in advance!

Hey everyone,

Exciting news for our community, in collaboration with the r/ThreatIntel community!

We’re launching a brand new Discord server dedicated to cyber threat intelligence. It’s a space for sharing content, news, resources, and engaging in discussions with others in the cybersecurity field. Since the community is still in its early stages, it might not have all the features yet, so we’re eager to hear your suggestions, feedback, and criticisms.

Feel free to join us and share the link!

https://discord.gg/FbWvHSH57H

Hey guys! I built a telegram bot 🤖 for intel collection that monitors hacktivist group channels and forwards translated messages to a centralized feed. Currently tracking 18 groups, will add more in the coming weeks.

🎯 These groups tend to have short operational lifespans, so I'll continue curating active channels. Feel free to reach out if you notice any broken linksThanks!

Have a look if that interest you

/hgtrackerbot

Just wrapped up a weekend investigation into Amadey Loader's infrastructure! Started with 2 domains and ended up uncovering unique IPs and domains through pattern analysis.

• High concentration in Russia/China hosting

• Consistent panel naming patterns

• Some infrastructure protected by Cloudflare

https://intelinsights.substack.com/p/mapping-amadey-loader-infrastructure

I looked into AS44477, owned by Stark-Industries Solutions, a bulletproof hosting provider facilitating a wide range of malicious activity. Between August 13th and September 15th, I identified nearly 800 IPs linked to cybercrime, including threats like RedLine Stealer, Venom RAT, and Quasar RAT.

https://intelinsights.substack.com/p/bad-stark

One of the most interesting findings was the presence of Operational Relay Box (ORB) networks, used by APTs for espionage and evading detection.
If you're interested in collaborating or diving deeper into this issue, feel free to reach out!

Hi all,

I wrote a short post about the upcoming US elections and the Iranian involvement.

https://intelinsights.substack.com/p/2024-us-elections-and-the-iranian

The FBI has initiated an investigation into a suspected hack targeting Donald Trump’s 2024 campaign, allegedly carried out by Iranian state-sponsored hackers linked to the Islamic Revolutionary Guard Corps (IRGC). Microsoft has also warned of escalating Iranian cyber activities, including phishing and disinformation tactics designed to disrupt U.S. elections.

You're in charge of getting CTI up and running. While not having to think about a budget, let's also keep things realistic as to not just throw money at it and get all of the top-tier $$$ stuff.

With that in mind, what does your ideal CTI environment look like? Which tools and platforms do you use? Which integrations? How about sharing intelligence? How do you enrich? How do you do reporting? Feel free to add more about the environment you would love to have :)

Been kinda busy with school and forgot about this subreddit. So yeah. Game will probably be like last game except with better anti-cheat. This time there will be no whitelist so you can invite more players. Ill just have to be there to add them to a team.

Also. This time I will be manually adding you to a team as you join. Adding you pre-game is very stressful. (In other words dont post the team you want as it isnt needed this time)

I recently tracked down the operator behind the "TdataS" Telegram session stealer. How? Because he tested his own malware on his own computer.

His stealer performed perfectly. It packaged up his own personal data, snapped a screenshot of his desktop (exposing his source code), and exfiltrated it straight to a public drop zone I was monitoring.

Using 100% passive OSINT-no exploits, no bypassed authentication, I traced his Gofile tokens and Telegram sessions to unmask his entire operation.

It's the ultimate OpSec fail, and a goldmine for Threat Intel analysts.

Dive into the full case study:
[**https://maordayanofficial.medium.com/tdatas-stealer-from-c2-discovery-t