Curated Intelligence (@CuratedIntel) header
Curated Intelligence (@CuratedIntel) profile picture

Curated Intelligence

@CuratedIntel

Bringing together intelligence researchers and incident responders. #TrackThePlanet

curatedintel.org/
Joined September 2020
  • Tweets400
  • Following104
  • Followers14.1K
37Media
Photo by Curated Intelligence (@CuratedIntel)Photo by Curated Intelligence (@CuratedIntel)Photo by Curated Intelligence (@CuratedIntel)Photo by Curated Intelligence (@CuratedIntel)Photo by Curated Intelligence (@CuratedIntel)Photo by Curated Intelligence (@CuratedIntel)Photo by Curated Intelligence (@CuratedIntel)Photo by Curated Intelligence (@CuratedIntel)Photo by Curated Intelligence (@CuratedIntel)Photo by Curated Intelligence (@CuratedIntel)
Curated Intelligence retweeted
Chuong Dong (@cPeterr) profile picture
Chuong Dong@cPeterr15 Mar 2025
Reviving my blog with a complete analysis of the latest #LockBit #ransomware v4.0 Green! 🤠 chuongdong.com/reverse%20eng… h/t to @fwosar & @demonslay335 for all the crypto helps! Huge thanks to @BushidoToken & @CuratedIntel for the threat intelligence insight too! 🙏
Image from Chuong Dong (@cPeterr)
Image from Chuong Dong (@cPeterr)
Image from Chuong Dong (@cPeterr)
Image from Chuong Dong (@cPeterr)
10
85
6
294
44,611
Curated Intelligence retweeted
Will (@BushidoToken) profile picture
Will@BushidoToken26 Sep 2024
Got a new project to share later this year which will be published via @CuratedIntel — a community of researchers that are awesome at providing great feedback and insights. Keep a look out for it in the next few months! 📝 Last time we did, we made this: curatedintel.org/2023/07/the…
4
29
5,880
Curated Intelligence retweeted
Will (@BushidoToken) profile picture
Will@BushidoToken13 Aug 2024
PSA from the @CuratedIntel Community to the CTI industry — watch out for cybercrime groups seeking access to your vendor platforms ⚠️
Image from Will (@BushidoToken)
27
76
21,034
Curated Intelligence retweeted
Will (@BushidoToken) profile picture
Will@BushidoToken27 Sep 2023
We had some good convos in the @CuratedIntel community today based on this @thecyberwire interview Really interesting that @C_C_Krebs says the *most important skill* he looks for in a CTI analyst is their “ability to communicate risk to businesses” 🗣️⚠️ thecyberwire.com/podcasts/sp…
Threat intelligence discussion with Chris Krebs.

Threat intelligence discussion with Chris Krebs.

In this extended interview, Simone Petrella sits down with Chris Krebs of the Krebs Stamos Group at the mWISE 2023 Cybersecurity Conference to discuss threat intelligence.

thecyberwire.com
9
35
12,801
Curated Intelligence retweeted
Kostas (@Kostastsale) profile picture
Kostas
@Kostastsale20 Sep 2023
A Day in the Life of a CISO
11
124
14
458
65,499
Curated Intelligence retweeted
Zach (@svch0st) profile picture
Zach@svch0st15 Sep 2023
Replying to @phillmoore
@phillmoore and I posted a blog on a TTP observed in an #Akira Ransomware case. ➡️ Actor gains access to Hyper-V server (with EDR) and creates a fresh VM ➡️ Turns off server VMs and mounts Hyper-V data disk on new VM ➡️Starts encrypting vhdx files! cybercx.com.au/blog/akira-ra…
Image from Zach (@svch0st)
4
43
4
136
25,036
Curated Intelligence retweeted
Will (@BushidoToken) profile picture
Will@BushidoToken14 Sep 2023
TL;DR of ALPHV/BlackCat's essay on the MGM breach - The attack began ~8 Sept. - They stole data and gained admin on their Okta SSO & Azure cloud tenant - ~100 ESXi hypervisors were hit by ransomware on 11 September - No ransom was paid Read in full here: gist.githubusercontent.com/B…
Image from Will (@BushidoToken)
21
143
8
445
152,134
Curated Intelligence retweeted
Will (@BushidoToken) profile picture
Will@BushidoToken13 Sep 2023
⚠️ Use Microsoft Teams? Watch out for TeamsPhisher! While it is not usually possible to send files to MS Teams users outside your org, by security researchers found a bypass by manipulating Teams web requests 🔥 github.com/Octoberfest7/Team… Examples of MS Teams phish lures ⬇️ 1/3
Image from Will (@BushidoToken)
Image from Will (@BushidoToken)
2
142
5
403
82,608
Curated Intelligence retweeted
Will (@BushidoToken) profile picture
Will@BushidoToken8 Sep 2023
🆕 Pleased to share my latest blog for SANS FOR589: Cybercrime Intelligence 👾 We reviewed the latest cybercrime intrusion trends from the last 12 months & investigated a new Initial Access Br0k3r 🔍 ⬇️ Check it out 👇 🔗 sans.org/blog/evolution-of-c… #CTI #ThreatIntel #Cybercrime
Image from Will (@BushidoToken)
Image from Will (@BushidoToken)
2
46
2
151
45,972
Curated Intelligence retweeted
The DFIR Report (@TheDFIRReport) profile picture
The DFIR Report
@TheDFIRReport28 Aug 2023
HTML Smuggling Leads to Domain Wide Ransomware ➡️Initial Access: Thread-Hijacked Email > HTML Attachment ➡️Credentials: LSASS Access, SessionGopher ➡️Lateral Movement: RDP, PsExec ➡️C2: IcedID, Cobalt Strike ➡️Impact: Nokoyawa Ransomware thedfirreport.com/2023/08/28… 1/X
HTML Smuggling Leads to Domain Wide Ransomware - The DFIR Report

HTML Smuggling Leads to Domain Wide Ransomware - The DFIR Report

We’ve previously reported on a Nokoyawa ransomware case in which the initial access was via an Excel macro and IcedID malware. This case, which also ended in Nokoyawa Ransomware, involved the threat...

thedfirreport.com
5
161
5
369
97,022
Curated Intelligence retweeted
Will (@BushidoToken) profile picture
Will@BushidoToken30 Aug 2023
📚 My new & recently updated #OSINT resources on @Github 1️⃣ Breach Report Collection github.com/BushidoUK/Breach-… 2️⃣ Cybercrime Police Raids github.com/BushidoUK/Cybercr… 3️⃣ UK critical infrastructure attacks github.com/BushidoUK/UK-Crit… Hope they’re helpful to someone 🙂
14
46
6,069
Curated Intelligence retweeted
monty (@_montysecurity) profile picture
monty@_montysecurity5 Aug 2023
Just published an in depth blog on threat hunting. I enumerate a concept I have dubbed the "Temporal Costs of TTPs". It is all stuff I think experienced SOC persons intuitively "know" but I have never seen discussed and I find helpful in structuring hunts montysecurity.medium.com/a-p…
A Practical Guide to Threat Hunting in Process Data

A Practical Guide to Threat Hunting in Process Data

Introduction

montysecurity.medium.com
44
1
102
12,460
Curated Intelligence retweeted
Will (@BushidoToken) profile picture
Will@BushidoToken16 Aug 2023
🐈‍⬛ New Cybercrime Intel Blog🕷️ Tracking Adversaries: Scattered Spider, the BlackCat affiliate 🔗 blog.bushidotoken.net/2023/0… #CTI #OSINT #cybercrime #threatintel
Image from Will (@BushidoToken)
1
46
138
16,734
Curated Intelligence retweeted
Will (@BushidoToken) profile picture
Will@BushidoToken5 Aug 2023
New Blog! Hacktivists: Liars and Morons 🔗blog.bushidotoken.net/2023/0… #hacktivist #hacktivism #cybercrime #CTI
Image from Will (@BushidoToken)
4
43
8
122
32,130
Curated Intelligence retweeted
Arkbird (@Arkbird_SOLG) profile picture
Arkbird@Arkbird_SOLG30 Jul 2023
Thanks to the help of @CuratedIntel members, we have updated the matrix of threat actor aliases from different TI vendors github.com/StrangerealIntel/…
Will (@BushidoToken) profile pictureWill@BushidoToken28 Jul 2023
New Google Threat Horizons is out! Found the Telecommunications Industry Profile section of the report handy and insightful! I also did some cryptonym decyphering with @Arkbird_SOLG's EternalLiberty (github.com/StrangerealIntel/…) Past blog on naming schemes (curatedintel.org/2022/05/thr…)
Image from Will (@BushidoToken)
Image from Will (@BushidoToken)
1
18
48
9,862
Curated Intelligence retweeted
Will (@BushidoToken) profile picture
Will@BushidoToken28 Jul 2023
New Google Threat Horizons is out! Found the Telecommunications Industry Profile section of the report handy and insightful! I also did some cryptonym decyphering with @Arkbird_SOLG's EternalLiberty (github.com/StrangerealIntel/…) Past blog on naming schemes (curatedintel.org/2022/05/thr…)
Image from Will (@BushidoToken)
Image from Will (@BushidoToken)
4
44
1
118
35,753
Curated Intelligence retweeted
Will (@BushidoToken) profile picture
Will@BushidoToken19 Jun 2023
🧵New #CTI assessment based on OSINT research: 🔎ScatteredSpider/0ktapus is a BlackCat (ALPHV) affiliate, but doesn't deploy ransomware - Based on some temporal, technical, and behavioral analysis Follow me 🐇🕳 (1/6)
2
36
1
129
51,522
Curated Intelligence retweeted
Daniel López (@0xDanielLopez) profile picture
Daniel López
@0xDanielLopez16 Jun 2023
🎉 Tweetfeed.live is now available at OpenCTI 🎉 The connector has been added to the official repo, complete with documentation on how to use it. This has been an awesome job done entirely by @aaarghhh 🔥 ➡️ github.com/OpenCTI-Platform/…
Image from Daniel López (@0xDanielLopez)
Image from Daniel López (@0xDanielLopez)
Image from Daniel López (@0xDanielLopez)
1
29
1
84
14,721
Curated Intelligence retweeted
棒 (@SttyK) profile picture
棒@SttyK14 Jun 2023
新しい記事を公開しました。 Etagを用いてTor Hidden Serviceを非匿名化する sh1ttykids.medium.com/etag%E…
Etagを用いてTor Hidden Serviceを非匿名化する

Etagを用いてTor Hidden Serviceを非匿名化する

筆者は主にShodanなどの一般に公開されているOSINTサービスのほか、アンダーグラウンドコミュニティなどの情報源から調査を行った。すでにサーバーが閉鎖されていること、容疑者と思われる人物が起訴されたことなどからレポートの公開へ踏み切った。

sh1ttykids.medium.com
27
1
87
13,853
Curated Intelligence retweeted
Will (@BushidoToken) profile picture
Will@BushidoToken6 Jun 2023
Summary of the MOVEit Transfer data-theft-extortion campaign. Analysis by the Equinix Threat Analysis Center (ETAC)™, made with @MaltegoHQ
Image from Will (@BushidoToken)
3
81
6
219
58,635
Load more