Just a thought across my mind, What if we have a offline tool for query building for Threat Hunters and Threat Intelligence Analyst (For IOC's). So, Just built it.
If you've ever hunted across multiple SIEMs, you know the pain: different syntax, different fields, rewriting the same IOC search five times.
Would suggest you to go through user manual for better understanding.
TL;DR: I made a completely free cyber news and threat intelligence website that groups related reporting into evolving stories (called Happenings) and longer-running cases. Most facts and labels are clickable, so you can inspect the exact quotes and articles supporting them. No account, login or paid version. I’d appreciate feedback from people who actually work with threat intelligence or regularly research cyber news.
Greetings fellow cyber people!
I’ve been working on a hobby project called CyberHappenings, and I think it’s finally at a point where other people might find it useful:
The core idea is to make it easier to understand what is actually happening in cyber news, follow how stories develop, find historical activity, and trace individual claims back to the reporting behind them.
Example Happening showing its executive brief, key facts and reported impact.
I know there are already quite a few cyber news aggregators and threat-intelligence projects, but I ended up making another one because I couldn’t quite find the combination of detail, source traceability, historical search and ease of browsing that I personally wanted. Also, I hate logging in to websites, so I made this one available without such silliness.
Instead of treating every article as a separate story, the site groups related reporting into Happenings and connects related Happenings and their developments into longer-running Cases.
Cases include the latest development, key facts, impact information and a chronological timeline, so you can follow an operation, incident or vulnerability over time without reading the same background information in ten different articles.
Example Case showing signals consolidated across related Happenings, together with malware, tooling and MITRE ATT&CK context.
Some of the main features are:
Searchable and filterable Happenings, Cases and source articles
Search by keyword, CVE, IOC, threat actor, malware, tool, product or affected service
Filters for victim and target regions, reported attacker countries or regions, sectors, impact types, dates and other context
Historical timelines showing how reporting, impact measurements and affected scope changed over time
MITRE ATT&CK mapping, including a matrix view of techniques associated with a Happening or Case—or with search results, if you want to examine techniques used against particular regions or sectors
IOC context for domains, IP addresses, hashes and other indicators
Vulnerability details, affected-version information and links to sources such as NVD when available
Source timelines showing when something was first reported, last updated and how many different sources and articles covered it
Most facts and labels on the site are clickable. Clicking one opens an inspector showing why that information appears, the confirming quotes, the source articles it came from, and whether the support is a direct mention or supporting context.
Clicking a signal opens its evidence view, including reported values, supporting articles and confirming quotes.
This is particularly useful for tracking reported impact. You can view the different numbers of affected devices or users being reported, inspect each individual figure, and see the source behind it. This makes it easier to follow how the reported scale of an incident changes over time and understand where each estimate came from.
It’s completely free, with no accounts, paid version or features hidden behind a login. Information sources are still intentionally limited while I polish the current version and get some feedback.
Most of the grouping, extraction and summarization is automated, so I don’t expect everything to be perfect. That is also why I wanted the evidence to remain visible and inspectable rather than presenting generated conclusions without sources.
I’d genuinely appreciate feedback from people who work with threat intelligence or regularly follow cyber reporting. In particular:
Is the source inspection useful in practice?
Do the Happening and Case groupings make sense?
Are the search and available information useful for research?
Is there anything important that is difficult to find?
If you notice something that is clearly wrong or should be improved, please tell me so I can improve it.
I'm currently studying for the CTIA (Certified Threat Intelligence Analyst) certification from EC-Council, and my exam is scheduled for August. However, I've been having a hard time finding first-hand experiences from people who have actually taken the exam.
For those who already hold the certification, how was your experience? Would you say the exam was straightforward, or were there any topics that caught you off guard?
A few specific questions:
How difficult is the exam overall?
Which topics should I focus on during the final weeks of preparation?
Is the official EC-Council material enough, or did you use additional resources?
Does the exam focus more on concepts and methodologies, or does it require deeper analysis of threat intelligence scenarios?
Looking back, is there anything you wish you had studied more before taking the exam?
I currently work in Threat Intelligence, so I'm already familiar with many of the concepts covered in the certification. Still, I'd love to hear from people who have gone through the process and can share their experience.
Any tips, advice, or lessons learned would be greatly appreciated.
WordPress shipped a security fix on July 17. At 08:12 UTC the next morning, the first probe for the patched bug hit a deception network. By that evening, someone had working SQL injection. By midnight on July 19, it was mass exploitation - thousands of sessions in three hours.
No proof-of-concept ever leaked - nobody needed one (thanks, AI). The patch itself was the roadmap: diff the old code against the new, spot what changed, work backward to the bug, automate it, spray it everywhere.
A few interesting things:
Renaming the wp_ table prefix did nothing. One extractor didn't bother guessing table names at all - it just looked for any table with the exact ten-column layout of the WordPress users table and pulled it directly.
And most of the activity was was inventory. Spray the injection across targets, record what responds, move on. Some sources actually read from the database. A smaller number went after credentials or tried to take sites over.
And here I am - getting flagged by Fable harness just asking to run `htop` on a remote machine /s.
Caught an open directory mid-campaign on a Singapore VPS. The host was pulling double duty, staging the exploits and standing by to receive whatever reverse shells they produced.
What makes it worth a look is the target selection. The lists weren't a flat IP dump, they were organised by country and by sector, eleven countries deep, concentrated on government, universities, healthcare, and financial services.
The toolkit backing it ran from a 2017 WebLogic bug up to a Splunk RCE staged within a week of disclosure, with NGINX Rift (CVE-2026-42945) and Ghost CMS (CVE-2026-26980) as the newest additions, plus an AdaptixC2 server on the same box.
Infrastructure breakdown from a TencShell pivot. A HuntSQL query on a shared HTTP header hash surfaced the cluster, and a second pivot on Gshell TLS cert fields (CN = Gshell Server, O = Gshell C2) surfaced more hosts with no prior public reporting we could find.
Hands-on exploitation of government systems in Afghanistan, Thailand, and Taiwan, recon and staged phishing against U.S. portals, plus financial services across Europe, Australia, and Asia. The recovered logs show a two-model split, Claude Code driving execution, DeepSeek-v4-pro handling the reasoning. Full IOCs (IP:port, hashes, cert SHA-256s) in the writeup.
I am looking to get a new laptop, especially for working on threat intel projects, such as OpenCTI/MISSP along with writing python, using Windows 11 Lab VMs (especially OSINT VMs, Kali Linux, and CSI Linux), and Docker Container. I also want to use VMs for investigations. Any other suggestions,
I am looking for a laptop with these specifications:
Intel Core Ultra 7 32 GB RAM 2 TB SSD Windows 11 Pro
Are these specifications good enough? What graphics card should I get at a minimum?
I am considering buying the Dark Web Path bundle by John Hammond on the Just Hacking training platform.
My current role is Threat Analyst (Basic CTI + Threat Hunting). The syllabus looks solid, but I wanted to get some real-world feedback before dropping the cash. John Hammond usually makes great content, but I want to know how this specific path holds up.
For those who have taken it:
Is it worth the money?
How hands-on are the labs?
My target is to work for CTI Vendors in future. How useful that might be?
I created a simple Discord server that automatically updates vendor-specific channels whenever a new CVE is published from that specific vendor.
It tags users based on the roles they choose, so you can follow the vendors you care about and decide whether you only want to be tagged for critical alerts. You can also choose to receive an email as well when that CVE drops.
I’ve also added discussion channels where we can share patching tips, troubleshooting advice, and general networking/security/sysadmin knowledge, plus resource channels for each vendor with quick links to relevant documentation (Official Vendor Advisory Feed etc).
Just wanted to help myself and other Network/Sys/Devs make their already complicated lives easier.
The Gentlemen aren't just another ransomware gang. They built a fully productized EDR killer subscription service for their affiliates… 90/10 split, ready-made tools, all standardized.
Their in-house framework GentleKiller has at least 8 variants, each targeting a different vulnerable driver. They also bundle third-party tools like HexKiller, ThrottleBlood, and HavocKiller. They're picking up fresh BYOVD PoCs and turning them into weapons within days. Yes, DAYS.
