Saw @censys awesome blog about Columbian C2 servers (https://censys.com/blog/unmasking-the-infrastructure-of-a-spearphishing-campaign) and thought I'd do a quick OSINT walkthrough.

Thread below !

(0/???)

MerkleMap

A tool to search for domains using wildcards. Useful both for phishing and typosquatting investigations and for finding subdomains/linked sites.

Partially free. May work with a slight delay.

merklemap.com

New release: FlowIntel 1.6.0 — an open-source case management tool — now with extended support for importing MISP events as cases, a timeline view for attributes, a new templating system for notes, and many other new features!

https://github.com/flowintel/flowintel/releases/tag/1.6.0
https://github.com/flowintel/flowintel

@misp @circl

#opensource #threatintel #threatintel #dfir #cti #misp #flowintel

Thanks to @davcru for the continuous work on the project and all the new contributors.

MISP 2.4.211 & 2.5.13 Released - A Double Dose of Security, Search, and Stability.

These releases are packed with critical security patches, a major overhaul of the search functionality, and a host of improvements and bug fixes to enhance your threat intelligence experience.

#opensource #threatintelligence #threatintel #cti

https://www.misp-project.org/2025/06/06/misp.2.5.13.and.2.4.211.html/

I set up a few honeypots in Europe this weekend mdr.

My servers found Russian unreported, so I guess it works fine. So I feed a list + self-report to AbuseIP every day.

It's downloadable for everyone for free

https://github.com/DXC-0/Malicious-Robots.txt

I haven't posted here in ages so... Please share, this is my the start of my book on CTI I'm releasing as a series of articles, because it took too long. However, its also a CTF as over time you need to unlock content thru challenges. I hope you enjoy #CTI #infosec Part 1 and 2 included here.

https://cybersecstu.medium.com/my-book-on-cyber-threat-intel-that-never-quite-made-it-as-a-book-chapter-1-1-faeb57a7e1a1

https://medium.com/@cybersecstu/my-book-on-cyber-threat-intel-that-never-quite-made-it-as-a-book-chapter-1-2-36fc5b9fad64

Eyes up. HackRead pulled together a fresh list of OSINT tools making waves in 2025.

FBI Watchdog — tracks domain seizures as they happen
VenariX — scrapes ransomware chatter from the dark
Telegago — digs through Telegram groups, trends, sentiment

Not the usual suspects. Worth a look.

https://hackread.com/2025-top-osint-tools-take-on-open-source-intel/

#CTI #WrongAnswersOnly a thread, a cry for help, a meeting survival game? Yes!

"threat data smearing"

Okta has published a decent repository of custom detection and hunting queries for your Okta tenant. I highly recommend taking a look and considering implementation, bearing in mind the likelihood of false positives.

I also recommend monitoring for any user enabling impersonation access for support cases. This allows Okta engineers into your tenant, and threat actors will abuse this to pivot. Any attempts to turn this on should be audited to ensure it aligns with remote troubleshooting with Okta engineers.

Finally, audit any Okta admins who run reports from the admin portal. Threat actors love these reports to identify org MFA policies, password health, and admin role assignments.

https://sec.okta.com/articles/2025/05/leveraging-okta-syslogs-for-proactive-threat-detection/

https://support.okta.com/help/s/article/approving-a-read-only-impersonation-access-request-for-a-support-case?language=en_US

https://help.okta.com/en-us/content/topics/reports/report-types.htm

Spike in Fortinet CVE-2024-55591 vulnerability rapidly increased in the past week

The #CrowdSec Network has detected a wave of exploitation attempts targeting CVE-2024-55591, a Fortinet vulnerability that affects FortiWAN versions before 5.3.2. First seen on April 23rd, the CrowdSec Network still sees elevated levels of probing and exploitation.

About the exploit:
This flaw allows remote attackers to perform unauthenticated command injection on exposed FortiWAN instances. This vulnerability affects FortiWAN versions prior to 5.3.2. It enables attackers to execute arbitrary commands via crafted HTTP requests — no authentication required.

Trend analysis:
April 23rd: The CrowdSec Network detects a shift in the long-term trend of CVE-2024-55591 exploits.
April 23rd - April 28th: Activity increases rapidly from 30 to about 80 malicious IPs reported daily, producing over 400 distinct attack events.
April 29 - May 2nd: The attackers take a break. This provides a key point of insight into the nature of this attack campaign.
May 3rd - May 19th: The attack picks back up with increased intensity. It now originates from around 200 unique IP addresses per day and produces about 900 attack events per day.
May 19th: The CrowdSec Network still sees elevated levels of probing and exploitation attempts.

How to protect your systems:
You can use CrowdSec’s open CTI search bar and blocklists to stay ahead of the curve. https://app.crowdsec.net/cti?q=cves%3A%22CVE-2024-55591%22&page=1
Alternatively, you can use CrowdSec’s newest tool, IPDEX, to build instant reports for this particular CVE and explore the data CrowdSec has aggregated. https://www.crowdsec.net/blog/introducing-crowdsec-ipdex

For more information, visit http://crowdsec.net [1/2]

There is an unusual high amount of activity targeting products by Apple https://vuldb.com/?vendor.apple #apple #vendor #cti #apt

Sicurezza è Lavoro: dal cantiere al cloud, dobbiamo proteggere chi costruisce l’Italia!

Link all'articolo : https://www.redhotcyber.com/post/sicurezza-e-lavoro-dal-cantiere-al-cloud-dobbiamo-proteggere-chi-costruisce-litalia/