Weekly Threat Intel: Agent Tool Chaining Abuse, September 2026 IoT CVEs and Loader Activity
This week's threat intel digest: agentic AI tool chaining abuse, September 2026 IoT CVEs, and active loader campaigns — with concrete detection and…
Weekly threat briefings, zero-day and CVE analysis, KEV updates.
Weekly Threat Intel: MCP Tool-Poisoning Incidents, Fall 2026 Firmware CVEs, and Stealer Log Markets
This week's verified threat intel: MCP tool-description tampering incidents, newly patched firmware and network device CVEs, and infostealer dump activity…
Weekly Threat Intel: LockBit Successor Shuffles, September 2026 Edge Device CVEs and Loader Chains
Weekly threat intel for defenders: LockBit affiliate reshuffles, actively exploited edge/VPN CVEs, and infostealer-to-ransomware chains with hands-on detection and hardening actions.
Weekly Threat Intel: Ransomware Affiliate Rotation, Autumn 2026 Exploitation and Infostealer Ops
This week's threat intel: ransomware affiliate rotation between lockers, actively exploited CVEs defenders must patch now, and infostealer operations feeding the access broker economy. Actionable blue-team guidance.
Pyramid of Pain to Production: How Detection Engineers Prioritize What to Hunt
A hands-on guide mapping the Pyramid of Pain and MITRE ATT&CK to real detection engineering decisions: what to hunt first, which telemetry to collect, and…
Weekly Threat Intel: 30 September 2026 — npm Malware, Typosquat Waves and Autumn CVEs
This week's threat intel digest: npm malware campaigns, typosquat waves, loader shifts and newly exploited CVEs — verified facts, IOCs and hands-on detection steps for practitioners.
Shodan and Censys for Attack Surface Recon: A Hands-On OSINT Lab with Ethics Guardrails
Learn attack surface reconnaissance with Shodan, Censys, and crt.sh in this hands-on OSINT tutorial for blue-teamers and CTF players, with clear ethical…
Weekly Threat Intel: 27 September 2026 — Agentic Supply Chain Abuse and CVE Trades
This week's threat intel digest: ransomware loader shifts, actively exploited CVEs, and how adversaries abuse AI agent tooling in software supply chains. Verified facts, hands-on detection guidance for blue teams.
Threat Hunting, Explained: Hypotheses, Telemetry and the Pyramid of Pain
The proactive complement to alerting: hypothesis-driven hunts, Bianco Pyramid of Pain economics, the maturity model, and the detection conversion loop.
Weekly Threat Intel: 26 September 2026 — Ransomware Crews Adopt Agent Tooling
This week's threat intel: exploited CVEs, ransomware affiliates adopting AI agent tooling, stealer-to-ransomware handoff tradecraft, and hands-on blue-team detection guidance for 22 September 2026.
Weekly Threat Intel: OAuth App Abuse, Autumn 2026 CVE Exploitation, and Malware Loader Trends
This week's threat intel roundup: OAuth third-party app abuse, actively exploited Autumn 2026 CVEs, and malware loader trends — with defender actions mapped to each tradecraft pattern.
Weekly Threat Intel: Supply Chain Compromises, Autumn CVE Exploitation and Infostealer Trends
Supply-chain compromise of a maintained npm package, active exploitation of autumn KEV CVEs, and infostealer delivery trends — the week’s threat picture and what defenders should do about each.