A darknet leak from Russian research institute Spetsvuzavtomatika reveals an automated cyber espionage ecosystem linked to the SVR.

Dive into the August Newsletter: Leaked documents expose Russia's cyber training pipeline, plus new findings on Silver Fox malware and account farming.

An analysis of the Okenit leak revealing "Lemmings," a Russian software framework automating synthetic persona provisioning for active measures campaigns.

A leaked cache of files reveals how Bauman University’s Department No. 4 serves as a training pipeline supplying military cyber operators to GRU units APT28 and Sandworm.

Commentary followed by links to cybersecurity articles and resources that caught our interest internally.

Analysis of post-arrest Silver Fox MaaS operations distributing Gh0stRAT via spoofed DeepSeek and enterprise lures, bloated installers, and multi-cloud infrastructure.

Fresh from Hacker Summer Camp, Daniel Schwalbe breaks down pro-Iran cyber militias, Mexican "Cita Express" scams, and illicit IRGC financial networks.

Explore how agentic AI accelerates threat hunting by 10x, a deep dive into APT35’s internal operations, and B2B2C supply chain attacks in the DTI December newsletter.

Uncover how the Zedxion Corporate Nexus and Babak Zanjani network deploy UK shell companies, digital tokens, and UAE trade entities for IRGC sanctions evasion.

Explore how account farmers exploit lax signup friction to inflate metrics and sell verified accounts. Discover key IOCs and mitigation strategies.

Discover how scarcity scams exploit government service bottlenecks to commit wire fraud and identity theft. Learn the tactics behind fake fast-track portals.

Threat Intelligence Report: The Pro-Iran Hacktivist Ecosystem 2026

June’s roundup of research - from cyberattacks on water infrastructure OT and ICS to DNS hijacking and an AiTM campaign targeting Microsoft365 users.

Explore DTI’s 2026 threat intelligence report on nation-state targeting of water systems. Learn how Volt Typhoon, Sandworm, & Iran exploit critical OT vulnerabilities.

APT35/Charming Kitten's leaked documents expose the financial machinery behind state-sponsored hacking. Learn how bureaucracy, crypto micro-payments, and administrative ledgers sustain Iranian cyber operations and link them to Moses Staff.

New research exposes Russian GRU (APT28) cyber operations using router compromise, DNS hijacking, and Signal/WhatsApp phishing for long-term espionage.

A sophisticated AiTM phishing kit bypassing traditional MFA to steal Microsoft 365 session cookies. Get the full breakdown and IOCs.

Analysis of ZionSiphon (SCADA_SecurityPatch_v8.4.exe), a .NET OT malware targeting Israeli water utilities. Discover its IOCs, targets, and flawed activation code.

How does the Doppelgänger influence campaign reach 5M+ users? Read DTI’s latest report on the SDA/Structura ecosystem, featuring a deep dive into narrative propagation, domain rotation tactics, and a 72-hour crisis influence timeline.

Systems thinking, biolistics, and the danger of mop-up science in infosec — plus this month's reading on ransomware, RPKI exploits, cPanel, and LLM pollution.

DPRK's modular malware portfolio, Iran's MOIS-linked Handala/Homeland Justice/Karma persona ecosystem, and a fake Authenticator Chrome extension dissected.

Analyze the DPRK "Contagious Interview" campaign targeting developers. Get technical deep-dives into VS Code task abuse, Node.js malware obfuscation, and a full Sigma/EDR detection pack to defend your CI/CD pipeline and identity perimeter.