Cyber threat intelligence analyst alien monitoring Nation State adversaries, eCrime activity, ransomware, malware, and global attack infrastructure

Threat Intelligence Directory

Map the actors, campaigns, technologies, and geopolitical forces shaping modern cyber conflict. Search the complete intelligence directory or begin with one of the core domains below.

Core Intelligence Domains

Nation State

Espionage, influence, disruption, and strategic operations conducted in pursuit of geopolitical advantage.

23 articles

eCrime

Ransomware, extortion, illicit markets, and financially motivated adversaries operating at industrial scale.

27 articles

Hacktivism

Ideological disruption, data leaks, defacement, and influence activity shaped by geopolitical events.

2 articles

Gen AI

Generative AI, autonomous agents, offensive use, model security, and the accelerating machine-driven threat landscape.

29 articles

Explore by Topic

Go deeper into the adversaries, methods, technologies, and geopolitical forces behind the headlines.

Adversaries

Tradecraft

Technology

Geopolitics

All Intelligence Topics

139 intelligence topics

Sort by
Academia Universities, research institutions and the intersection of academic collaboration with intelligence collection, covert funding and national security. 1 Post AI Security Analysis of AI agents, frontier models, and autonomous systems as attack surfaces, defensive tools, and operational risks. Coverage examines containment, oversight, model behavior, and the security claims surrounding rapidly deployed AI. 13 Posts Amadeus Security analysis of Amadeus and the travel technology infrastructure connecting airlines, reservations, passenger data, service providers, and inherited supply chain exposure. 1 Post Android Android devices viewed through platform design, privacy, AI, security, hardware, software, and the real-world tradeoffs of moving beyond the Apple ecosystem. 4 Posts Apple Analysis of Apple security, mobile exploits, patch adoption, platform protections, surveillance risk, privacy, and adversary tradecraft targeting iPhone and the wider ecosystem. 2 Posts Arara 1 Post ARTEX ARTEX is an open-source agentic penetration-testing framework developed in China. Coverage follows its use in financial intrusions, model integration, automation, and the forensic trail left by AI-assisted operations. 3 Posts Attribution Analysis of cyber attribution, confidence assessments, adversary deception, competing vendor names, and the intelligence discipline required to connect observed tradecraft with a responsible actor. 6 Posts Automotive Cyber security in connected vehicles, infotainment systems and automotive software. Coverage examines updates, embedded platforms and the expansion of the attack surface. 1 Post Aviation Analysis of airline cyber security, reservation infrastructure, passenger data, aviation supply chains, service provider compromise, operational resilience, and systemic technology risk. 1 Post BANISHED KITTEN BANISHED KITTEN is an Iranian threat actor associated with the Ministry of Intelligence and Security and tracked in reporting as VOID MANTICORE. Explore destructive intrusions, data theft, leak campaigns, and hacktivist personas used to amplify political pressure. Coverage examines operational tradecraft, attribution confidence, and the relationship between public messaging and state objectives. Separate demonstrated capability from publicity and assess the consequences of cyber disruption. 1 Post Binance Security reporting on Binance, cryptocurrency theft, social engineering, privileged access, blockchain infrastructure, and North Korean operations targeting the exchange. 3 Posts BLOODALCHEMY 1 Post Botnet 1 Post BYOD 1 Post Chainalysis Analysis of Chainalysis, blockchain intelligence, cryptocurrency investigations, security incidents, exposed identity data, and the risks surrounding systems mapping illicit finance. 1 Post ChatGPT Analysis of ChatGPT, OpenAI agents, model behavior, security controls, containment failures, offensive use, and the gap between frontier AI capability and reliable oversight. 3 Posts China China nexus cyber activity examined across emerging offensive tooling, AI-assisted intrusion, regional targeting, eCrime, and the intelligence gaps separating technical evidence from attribution. 11 Posts CISA 1 Post Cisco 1 Post Claude Claude and Claude Code through the lens of security research, adversary workflows, agentic systems, operational memory, forensic artifacts, and the risks created by persistent AI context. 4 Posts Cloud Security Cloud infrastructure, privileged identities, secrets, control planes and the trusted services adversaries exploit. Practical lessons from cloud compromise and recovery. 3 Posts Counter-Intelligence 2 Posts COZY BEAR Intelligence on the Russia SVR nexus adversary tracked as COZY BEAR, including espionage campaigns, targeting, infrastructure, mobile exploitation, supply chain access, and evolving tradecraft. 2 Posts Crédit Mutuel Arkéa 1 Post Critical Infrastructure Threats to essential systems, including water, energy and communications. Coverage connects adversary objectives, operational technology and the consequences of disruption. 1 Post CrowdStrike Analysis of CrowdStrike technology, threat intelligence, product claims, AI security controls, incident response, adversary research, and the operational reality behind security marketing. 4 Posts Cryptocurrency Analysis of cryptocurrency theft, blockchain intelligence, laundering, sanctions evasion, and the infrastructure moving illicit value through the eCrime and nation state ecosystem. 10 Posts Cyber Resilience Independent recovery, resilient architecture, backups and business continuity. Coverage examines shared failure domains and what keeps operating when primary systems fail. 3 Posts Cyber Security Independent analysis of breaches, defensive architecture, security operations, resilience, cloud risk, identity, and the failures allowing capable adversaries to turn technical access into operational consequence. 35 Posts
Cyber Threat Intelligence Intelligence-led analysis of adversary intent, capability, infrastructure, tradecraft, attribution, and geopolitical context. Coverage translates complex activity into findings defenders, executives, and governments can act upon. 10 Posts CyberAv3ngers Reporting on CyberAv3ngers and Iranian cyber operations targeting water utilities and other critical infrastructure, including attribution, disruption and government responses. 1 Post Dark Web Criminal forums, illicit marketplaces and dark web monitoring. Connecting stolen credentials, underground commerce and adversary relationships with broader threat intelligence. 3 Posts DarkBlinders Intelligence on the Iran nexus espionage activity tracked as DarkBlinders, including social engineering, malicious job lures, GitHub infrastructure, cloud collection, and overlapping vendor names. 1 Post Darksword Intelligence on Darksword mobile exploitation tooling, delivery infrastructure, and campaigns using compromised websites to target unpatched Apple and Android devices. 1 Post Data Breach Analysis of data breaches, intrusion paths, exposed identity data, delayed disclosure, third-party compromise, organizational accountability, and the operational consequences following access. 13 Posts DeepSeek DeepSeek models assessed across agentic systems, offensive security workflows, automated penetration testing, adversary operations, model behavior, and the security implications of low-cost AI capability. 4 Posts Defense Industry 1 Post Department of Homeland Security (DHS) Analysis of DHS cyber security, surveillance, identity systems, law enforcement operations, exposed personnel, metadata risk, and the technologies supporting federal missions. 1 Post deviantART deviantART, its creative community and the dynamics of visibility, trust and influence. Perspectives connecting digital communities with technology and threat intelligence. 1 Post DigitCert 1 Post DNS The Domain Name System underpins how users reach websites and services, making control of DNS a point of leverage for adversaries. Explore domain hijacking, malicious nameserver changes, registrar compromise, and the infrastructure behind phishing, malware, and cryptocurrency theft. Coverage examines how trusted addresses can lead to hostile destinations without compromising the underlying application. Understand the privileges, dependencies, and defensive controls protecting digital trust. 1 Post Drones 1 Post eCrime Analysis of financially motivated adversaries, ransomware and extortion operations, access brokers, fraud, and the eCrime ecosystem disparate adversaries and specialized development to intrusion and profit. 27 Posts Encryption Analysis of encryption standards, cryptographic implementation, post-quantum security, adversary adoption, and the consequences when protective mathematics becomes operational tradecraft. 4 Posts Espionage Analysis of cyber espionage, intelligence collection, surveillance, influence, access operations, and the geopolitical requirements driving nation state adversaries toward specific targets. 11 Posts Extortion Analysis of cyber extortion, public pressure campaigns, leak sites, ransom negotiation, reputation attacks, and the business models turning unverified claims into leverage. 10 Posts Facebook Facebook product design, notifications and engagement incentives. Commentary on the platform choices shaping user attention, trust and experience. 1 Post FAMOUS CHOLLIMA 1 Post FANCY BEAR Intelligence on the Russia GRU nexus adversary tracked as FANCY BEAR, including espionage, defense targeting, credential operations, infrastructure, malware, and campaigns against NATO interests. 2 Posts Financial Services Industry (FSI) Threat intelligence for financial services, covering banks, exchanges, payment platforms, cryptocurrency, social engineering, AI-assisted intrusion, data theft, and the adversary tradecraft targeting financial infrastructure. 10 Posts FIRE ANT China-nexus espionage activity tracked as FIRE ANT. Coverage examines virtualization, network infrastructure, stealth and qualified overlaps with other vendor designations. 1 Post France France's cyber security challenges reach beyond breached networks into public services, critical infrastructure, national security, and the technology supply chain. Explore intrusions, ransomware, espionage, and disruption affecting French organizations, with attention to nation state, ecrime, and hacktivist adversaries. Reporting connects compromise with operational consequences and geopolitical context, examining how supplier dependencies and security decisions shape resilience and trust. 2 Posts Gen AI Analysis of generative AI, autonomous agents, frontier models, AI security, offensive use, model behavior, and the rapidly changing line between human and machine decision making. Focused on what AI can actually do, where it fails, and what its adoption changes. 29 Posts Geopolitics Analysis connecting cyber operations with state power, alliances, conflict, economic pressure, intelligence priorities, and the political decisions shaping adversary intent and targeting. 9 Posts Germany 1 Post Github 1 Post Google Google’s technology ecosystem explored through AI, search, cloud services, privacy, software integration, product strategy, and the decisions shaping how its platforms influence everyday technology. 4 Posts Government Cyber incidents, public-sector systems and government responses to digital threats. Coverage examines public services, accountability and the consequences for citizens. 2 Posts Hacktivism Hacktivism sits where ideology, geopolitical conflict, and cyber disruption collide. Explore politically motivated intrusions, denial-of-service attacks, website defacement, data leaks, and influence operations. Coverage examines the motivations and tradecraft of hacktivist adversaries, their overlap with nation state and ecrime operations, and the gap between public claims and demonstrated capability. Understand who benefits, what actually happened, and when activism becomes operational harm. 2 Posts Healthcare Cyber incidents, patient-data exposure and the shared technology supporting healthcare. Coverage examines providers, suppliers and the consequences of compromised trust. 1 Post Identity Security Authentication, authorization, session theft and trusted access. How adversaries abuse valid identities and why a successful login does not establish legitimate intent. 8 Posts Influence Operations Narrative manipulation, propaganda and attempts to shape public opinion or political decisions. Coverage includes generative AI and the erosion of shared trust. 1 Post Information Operations 1 Post Instagram Instagram algorithms, feeds and platform design. Commentary on user choice, attention and the business incentives shaping the experience. 1 Post
Intelligence Brief Intelligence Brief connects developments across cyber security, threat intelligence, technology, and geopolitics in a single edition. Each briefing brings together multiple stories with source links, operational context, and independent assessment from Scott Jarkoff. Expect coverage of nation state, ecrime, and hacktivist adversaries alongside emerging technologies and institutional failures. Understand what changed, why it matters, and how apparently separate events reveal shared risks. 4 Posts iOS iOS viewed through platform design, privacy, security, software constraints, ecosystem integration, and the experience of comparing Apple’s mobile operating system with Android. 1 Post IoT Security Security and privacy of connected devices, embedded software and consumer sensors. The risks hidden inside everyday products, trusted updates and persistent network connections. 4 Posts iPhone iPhone hardware and iOS considered alongside privacy, security, ecosystem design, product decisions, and the real-world experience of choosing between Apple and Android devices. 1 Post Iran Analysis of Iran nexus cyber operations, espionage, influence, regional targeting, adversary infrastructure, social engineering, and the intelligence requirements shaping state activity. 3 Posts Italy 1 Post Japan Analysis and observations from Japan covering cyber security, digital sovereignty, national resilience, technology, policy, Tokyo life, and the forces reshaping the country. A view of Japan from inside the systems, culture, and decisions defining its future. 8 Posts Kazakhstan Analysis of Kazakhstan nexus cyber activity, regional espionage, targeting across Russia and Central Asia, and the diplomatic and security interests shaping collection requirements. 1 Post KillSec KillSec illustrates how hacktivist branding can evolve into a commercial ransomware operation. Follow its ransomware-as-a-service platform, affiliate relationships, data theft, extortion, and the infrastructure supporting its business model. Coverage examines the economics lowering barriers to entry, the division of labor behind attacks, and the consequences of law enforcement disruption. Seizing servers can damage an operation without eliminating the capabilities or incentives sustaining it. 1 Post LABYRINTH CHOLLIMA 1 Post Leadership Essays on leadership, management, workplace culture, trust, talent, and the organizational failures people are often expected to tolerate in silence. An unsentimental look at what strong leadership earns, what weak leadership destroys, and why people leave. 3 Posts Links Quick links and commentary on external stories, reports, and developments worth following across cyber security, threat intelligence, technology, geopolitics, and the wider digital world. Curated for relevance, context, and the signal hiding inside the noise. 1 Post Malware Backdoors, loaders, infostealers and other malicious software. Coverage follows delivery, execution, persistence and the tradecraft used to evade detection. 8 Posts Meta Meta platforms, leadership and product strategy. Examining the incentives behind engagement algorithms, user choice and the governance of social media. 1 Post Microsoft Microsoft security products, vulnerabilities, identity platforms and threat reporting, examined through operational impact and the gap between claims and defensive outcomes. 6 Posts Mirax Mirax is Android banking malware enabling adversaries to take control of infected phones and abuse financial applications. Explore deceptive installation lures, Accessibility Service abuse, credential theft, banking overlays, and residential proxy capabilities. Coverage examines remotely supplied configurations and the fraud model behind transactions originating from a victim's own device. Understand why familiar devices and valid authentication can conceal hostile control of a banking session. 1 Post Mobile Security Analysis of mobile exploitation, zero-click compromise, malicious delivery infrastructure, surveillance tooling, and the operational risk created by unpatched Apple and Android devices. 1 Post Money Laundering 2 Posts Nation State Intelligence analysis of nation state adversaries, strategic intent, espionage, disruption, influence, targeting, infrastructure, and the geopolitical requirements shaping cyber operations. 23 Posts North Korea (DPRK) Intelligence on North Korean cyber operations spanning cryptocurrency theft, espionage, sanctions evasion, malware, post-quantum encryption, infrastructure, and financially motivated state activity. 7 Posts NSA The United States National Security Agency, its intelligence priorities, cyber mission and organizational changes in response to emerging strategic threats. 1 Post Nvidia 1 Post OpenAI Analysis of OpenAI security, frontier models, autonomous agents, insider risk, physical security, containment, model behavior, governance, and the claims surrounding rapidly deployed AI. 6 Posts OpenSSH 1 Post Openwave 1 Post Opinion Direct commentary on technology, security, travel, business, culture, and the systems failing people in plain sight. Arguments grounded in experience and unwilling to accept the convenient explanation. 9 Posts PAN-OS 1 Post Personal Reflections Personal essays on relationships, career decisions, autonomy and growth. Reflections on the encounters and choices shaping a life. 2 Posts PLUMP SPIDER The Brazil-based eCrime adversary tracked as PLUMP SPIDER. Coverage examines banking-software compromise, fraudulent transfers and manipulation of payment infrastructure. 1 Post PRESSURE CHOLLIMA Intelligence on the North Korea nexus adversary tracked as PRESSURE CHOLLIMA, including cryptocurrency theft, financial targeting, infrastructure, operational tradecraft, and attribution. 5 Posts Privacy Digital privacy across platform data collection, mobile ecosystems, surveillance risk, security tradeoffs, and the choices determining how much control people retain over their devices and information. 8 Posts Ransomware Analysis of ransomware groups, extortion models, negotiators, leak sites, access brokers, victim pressure, recovery failures, and the criminal ecosystem sustaining the operation. 10 Posts Revolut Revolut security, customer-data protection and financial-services risk. Coverage follows fraudulent information requests, social engineering and cyber extortion. 2 Posts Russia Analysis of Russia nexus cyber operations, military intelligence, foreign intelligence, espionage, destructive activity, influence, infrastructure, and targeting shaped by state priorities. 8 Posts Samsung Samsung devices examined through Android, Galaxy hardware, software design, AI, privacy, security, and the product decisions challenging Apple’s mobile ecosystem. 1 Post SEGA 1 Post ShinyHunters Reporting on ShinyHunters, data theft, extortion and the relationships sustaining a fluid criminal collective. Attribution and operator claims are assessed with appropriate caution. 3 Posts Silver Fox Activity tracked as Silver Fox, including ValleyRAT delivery, signed-software abuse and social engineering. Coverage follows malware tradecraft without assuming a confirmed state sponsor. 1 Post Site Updates Changes to jark.me, its publishing platform, design and features. Notes on building an independent publication and retaining ownership of its content. 1 Post SLIM SPIDER The Brazil-based eCrime adversary tracked as SLIM SPIDER. Coverage follows cloud identities, custody credentials, financial targeting and abuse of trusted infrastructure. 1 Post Smartphones Smartphone hardware and mobile operating systems considered alongside privacy, AI, security, ecosystem lock-in, and the design choices shaping how people use technology every day. 1 Post Social Engineering How adversaries exploit job lures, impersonation, trust, manipulated workflows, credential theft, malicious files, and human decision making to bypass technical controls. 10 Posts Social Media Platform algorithms, engagement design and the incentives shaping online attention. Commentary on user choice, manipulation and the companies controlling digital conversations. 2 Posts Sony 1 Post South Korea Cyber operations affecting South Korea, including financial targeting, AI-assisted intrusion, regional adversaries, data theft, emerging offensive tooling, and the wider security implications for Northeast Asia. 2 Posts Spyware 1 Post Storm-0940 1 Post Storm-3358 1 Post Supply Chain Analysis of third-party compromise, shared technology risk, service providers, trusted access, inherited exposure, and the failures allowing one intrusion to reach entire industries. 14 Posts Surveillance Connected devices, sensors and the collection of personal information. Examining what technology observes, where the data goes and who controls access. 1 Post TA419 China-nexus espionage activity tracked as TA419. Coverage examines targeted social engineering, credential phishing and collection against policy and research communities. 1 Post Technology Analysis of products, platforms, infrastructure, digital markets, design choices, and the technology decisions reshaping security, work, travel, culture, and everyday life. 7 Posts Thailand 1 Post The Gentlemen Intelligence on The Gentlemen ransomware operation, including victim claims, leak site activity, extortion pressure, affiliate behavior, unverified breaches, and the economics of public accusation. 2 Posts TITAN Reporting on the TITAN ransomware operation, affiliate recruitment and extortion claims. Advertised AI capabilities are distinguished from independently verified findings. 1 Post UK NCSC 1 Post UNC3569 Activity tracked as UNC3569, including China-nexus exploitation of trusted software and GrayRabbit backdoor delivery. Coverage distinguishes observed tradecraft from broader attribution claims. 1 Post VAPOR PANDA 1 Post VICE SPIDER Reporting on the eCrime adversary tracked as VICE SPIDER, ransomware, data theft and extortion. Coverage separates verified victim disclosures from adversary claims. 1 Post VOODOO BEAR Intelligence on the Russia GRU nexus adversary tracked as VOODOO BEAR, including destructive operations, critical infrastructure targeting, living off the land tradecraft, malware, and operational handoffs. 2 Posts Vulnerabilities Security flaws, exploit development, disclosure and patching. The gap between identifying a weakness, deploying a fix and adversaries turning it into access. 11 Posts White House 1 Post WorkOS 1 Post

Latest Intelligence

Stolen AI API keys from Zeabur, Railway, and Northflank resold through momo and Xingjiabi, with USDT payments and model-copying infrastructure

Someone Is Reselling Your AI Key and Billing You for It

Sixteen AI developer platforms disclosed breaches in five weeks. The best-documented ones trace to credentials earlier cleanups left valid, and the stolen keys fed resellers whose buyers range from discount hunters to labs accused of distillation, while victims pay for every call made in their name.

AI Security Gen AI