Our monthly open source challenges just got an upgrade... With hidden codes - a corrupted archive and a mysterious figure pulling the strings. Get started at challenge.bellingcat.com

We recently released the Synapse @Feedly Power-Up! Ingest Feedly TI API feeds into Synapse, model articles as media:news, link indicators, and automate daily/hourly pulls to speed up reporting + enrichment. Learn more: synapse.docs.vertex.link/projects/rap...

What are they up to at Matt's in the Market in Seattle? 👀

You can now scan for #react2shell in Burp Suite! To enable, install the Extensibility Helper bapp, go to the bambda tab and search for react2shell. Shout-out to Assetnote for sharing a quality detection technique!

China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) #React2Shell aws.amazon.com/blogs/securi...

Made this last night, it’s useful for finding a large number of domains hosting phishing kits or malware based on a consistent pattern github.com/singe/domain-p… Might be useful for some of you.

If the talks at @cyberwarcon.bsky.social today are any indication, while you may think threat actor adoption of generative AI improves sophistication and eliminates telling mistakes in phishing and info ops, that future is not evenly distributed!

Ah @cyberwarcon.bsky.social the only conference for intel ops research authored by the terminally online

It’s rare that we see an actual NEW ransomware family, so it will be interesting to see how this develops. via @lawrenceabrams.bsky.social & @bleepingcomputer.com

Attackers move fast, so your blocklists should too. GreyNoise now lets you convert any query into a real-time blocklist that updates automatically as attacker infrastructure changes. Start using it today on the GreyNoise platform.

Great talk by @pylos.co on possible futures for Volt Typhoon and why the cluster's strategic goal means the activity will evolve and at times be disrupted but not stop any time soon

Now I can say I've seen a DPRK IT Worker (recorded) on a video call, thanks to Caleb Marquis and Eric Kerr! Next up is @pylos.co on Volt Typhoon.

Kicked off @cyberwarcon.bsky.social with @dmitri.silverado.org apologizing for 15yrs of threat actor naming chaos and proposing a new scheme, and plenty of Russia-related content (with top-tier memes)

Good morning, @cyberwarcon.bsky.social! ☕️

We've hired Colonel Shawn Smagh to up our @greynoise.io intel reporting game and we've started producing weekly intelligence briefs. This week's is a banger.

Game on! The @cyberwarcon.bsky.social Synapse challenge is live! 💚💚💚

Coming up at 12:40 EST for #IanGillespie presenting "From Memecoins to Missiles: How North Korea Launders Stolen Crypto into Real World Riches" #BSidesPyongyang25 #BSPY25 https://www.twitch.tv/bsidespyongyang https://www.youtube.com/@BSidesPyongyang

Watching @bsidespyongyang.bsky.social on the way to @cyberwarcon.bsky.social twitch.tv/BSidesPyongy...

Have questions about submitting to the #SOCON2026 CFP? We’ve got answers. The CFP closes soon — submit your proposal by Nov 15 to participate in the only conference dedicated to advancing Attack Path Management. 📝 Submit: ghst.ly/socon26-cfp

Obsidian Importer now lets you generate Markdown files from a CSV. It converts thousands records in seconds and automatically generates a Base that you can use to explore and edit the data.

cloud.google.com/blog/topics/... google cloud / mandiant blogged about a cool investigation that I got to pitch in on & had a small verse to contribute in the broader context of it. these are the things that remind me how much I enjoy what I do.

It was recorded, and slides are now being shared.... Slides and videos from ATT&CKcon 6.0 are now posted in an easy to find way. Check out attack.mitre.org/resources/at... to check out our great talks (and Couch Talks) from October, or even check out past ATT&CKcons from that same page.

There's an open role for a Staff CTI Analyst on my team here @huntress.com 📢💫 ✨Do you love doing correlations between different incidents, sometimes digging into them, or doing malware analysis? ✨Do you like doing data analysis, and using this to make threat reports? 👇

"The DPRK IT worker threat is more than a fraud or sanctions evasion issue; it exposes systemic weaknesses in how identity is verified and managed across the global economy." Chandana Seshadri looks at DPRK IT worker typologies & identifies a path forward.

Our new and improved Bellingcat Toolkit is one-year-old today! If you haven't used it yet its a one-stop shop for discovering useful open source tools, maintained by an amazing group of volunteers. You can find use cases, guidance and honest reviews for each tool. bellingcat.gitbook.io/toolkit

We are releasing details on BRICKSTORM malware activity, a China-based threat hitting US tech to potentially target downstream customers and hunt for data on vulnerabilities in products. This actor is stealthy, and we've provided a tool to hunt for them. cloud.google.com/blog/topics/...

First public report at Recorded Future by yours truly is out! RedNovember (formerly TAG-100, a.k.a. Storm-2077) is a Chinese state-sponsored threat group focused on intelligence collection, especially on flashpoint issues of strategic interest to China. www.recordedfuture.com/research/red...

CFP closes this Friday, September 26th at 11:59pm EST! If you'd like to speak at CYBERWARCON this year, get your talk submission in ASAP to be considered! Submit your talk here >> www.cyberwarcon.com/cfp2025 #CYBERWARCON #CFP

It is a good time to learn how to find accurate information online. We’re offering virtual training sessions over the month of October, teaching you Bellingcat’s investigative techniques…

For more than a year I’ve spoken with Scattered Spider “caller” Noah Urban from a Florida jail. I wanted to know how they chose victims, their methods and how Noah became entangled in a virtually and physically violent world. We’re publishing his story today: www.bloomberg.com/news/feature...

🔥🔥 Fresh research drop live from #labscon Arizona. @alex.leetnoob.com and @morecoffeeplz.bsky.social with @vkamluk.bsky.social The Hunt for LLM-enabled malware #ai #cyber #threatintel s1.ai/llm-mw

We're looking for some awesome folks to join our team! If one of these roles catches your eye, we'd love to hear from you. 👩‍💻 greynoise.io/careers

If you couldn't attend PIVOTcon live, our Threat Clustering Workshop is now available on the Vertex Intel-Sharing Synapse Instance! Examine real-world data and answer the age-old question: “Is this a cluster? Or a CLUSTER!?” Learn more here: vertex.link/blogs/threat...

Three things I wish I knew before starting in CTI: 1. You are going to repeat yourself a lot, and that is normal. You may often find yourself saying “remember I told you about this weeks ago.” It is easy to get frustrated when nobody reads your report, but repetition is part of the job.

submit

New research from @milenkowski.bsky.social (S1) and @kennethkinion.bsky.social (Validin): 🇰🇵 Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms Research: www.sentinelone.com/labs/contagi... Reuters story: www.reuters.com/world/asia-p...

TL;DR I am launching my #startup and we are going to change how to evaluate,cluster and reason about #malware, delivering accurate,contextual intelligence on samples. Say Hi to RationalEdge @rationaledge.bsky.social rationaledge.io #threatintel #threathunting #cti #reverseengineering #detection 1/9

an important, and often overlooked skill in threat intel, is being funny

CYBERWARCON is coming!!! Registration and CFP are now open for this year's #CYBERWARCON! This year's keynote speaker will be @dmitri.silverado.org!! We are back in Arlington, VA this year on November 19th. www.cyberwarcon.com

CYBERWARCON is back. 🗓️ Wednesday, Nov 19, 2025 | Crystal City + virtual 🔗 cyberwarcon.com

Sources & Methods #CTI newsletter issue 25 is out with more articles, tools, and conferences for you 📨 sourcesmethods.com/sources-meth...

Less than 3 hours left until our OCCRP Briefing | New Sanctions Evasion Playbook. Don't forget to sign up to join us2.campaign-archive.com?u=8a7b7dd3a0...

We should use Clue (1986) to explain Analysis of Competing Hypotheses to incoming analysts.

Want to learn what goes into finding stolen art? On Thursday at 5pm CEST /11am EDT we'll be joined by @artdetective.bsky.social , the citizen art detective behind the recovery of over 200 pieces of art including lost Picasso, Van Gogh and Dali works. Join us live for Q&A discord.gg/2fMCucQ5?eve...

As I watched infostealers encounters rise I wrote this guide for @esetresearch.bsky.social on the recovery process: www.welivesecurity.com/en/cybersecu...

There can be real costs for #ransomware. 'Alpha Medical Centre has been the victim of a serious cybersecurity attack. As a result of this criminal act and its devastating impact, we have no choice but to close the practice.' databreaches.net/2025/07/22/t... #cybersecurity @gate15.bsky.social

So this is as good a time as I’ll ever get to explain what I think is the difference between “software supply chain compromise” and “operational enablement” when it comes to cyber operations. It’s very easy to lump these two together, especially since they are both means of access development (1/x)

@volexity.com is looking to grow our Threat Intelligence team. New job posting for Senior Analyst role is up here: www.volexity.com/company/care... If you have any questions, don't hesitate to ask.

Standard Chartered Threat Intelligence team is looking for a new colleague who will help us with task automation, and particularly squeezing out even more juices from The Vertex Project Synapse platform we are using. 1/2

CYBERWARCON is back! Save the date for Wednesday, November 19, 2025, in Arlington, VA + virtually. Follow us to stay up to date for CFPs, volunteer opportunities + more! Check out for more information + sponsorship opportunities >> www.cyberwarcon.com