Threat Hunting Management Workshop: The Business Value of Threat Hunting

On October 29, Sr. Threat Hunt Analyst Scott Poley will share how security leaders can demonstrate the business value of threat hunting and show measurable results, even with limited resources.

Detecting cybercriminal activity on Telegram

Telegram hosts significant cybercriminal activity. In this Studio 471, Sayak Saha Roy of Louisiana State University discusses a research project leveraging a language model that can identify cybercrime-related postings.

Threat Hunting Workshop 16: Hunting for Persistence – Level 2

On September 24, 2025, from 12:00–1:00 PM ET, this hands-on workshop will strengthen your skills in detecting persistence techniques that adversaries use to maintain long-term access.

AI for Security Teams: Scaling Impact Without Losing Control

The next live Out of the Woods: The Threat Hunting Podcast explores how AI is reshaping security operations, from insider threat detection to faster triage and incident response. We’ll cover practical wins, common pitfalls, and the critical role of human expertise, while addressing risks like hallucinations, bias, and deepfake-enabled attacks.

Drawing value from cyber threat intelligence

Kobe Shwartz is a former Russian cybercrime analyst who is the Head of Cyber Threat Intelligence and Analysis at Signify. In this Studio 471, he discusses how to structure a CTI program and measure return on investment.

An Anatomy of “Pig-butchering” Scams

So-called “pig-butchering” scams have evolved into highly complex and profitable operations. Intel 471’s latest intelligence report dissects the structure of these scams, showing how threat actors leverage artificial intelligence (AI) and the cyber underground to enhance their operations’ scale and effectiveness.

Cybercrime Exposed Podcast: The Duke is Dead

DukeEugene is a Russian hacker, heavily tattooed with a large swastika on his chest. He specializes in developing malicious software for Android phones.

The Black Basta Blueprint

A deep-dive into the leaked internal chat logs for the Black Basta ransomware group and demonstrate how our expert analyses of the group’s malware tools and tactics, techniques, and procedures (TTPs) can be operationalized to harden your defenses against future attacks.

Defending against doxing

In this Studio 471, Jacob Larsen discusses the effects of doxing, how sites like Doxbin take advantage of legal loopholes and how to defend against being doxed.

Intelligence-Driven Threat Hunting Workshop: Analyzing Malware Behaviors

Join Intel 471 On July 31, 2025 from 11:00 AM - 1:00 PM ET for a live, hands-on workshop that bridges malware intelligence and threat hunting. Learn how to extract IOAs from real reports and apply the

UK 2025 Threat Landscape Report

The U.K. government announced their plans to introduce the landmark “Cyber Security and Resilience Bill”. Designed to elevate national security standards and protect critical infrastructure, it places greater responsibility on organisations to manage and withstand cyberattacks.

The Intersection of AI and Threat Hunting: What Problems Emerge, What Problems Get Solved

A live episode exploring how AI is being applied in threat hunting workflows, what problems it helps solve, and where new challenges are emerging.

Top Cybercrime Threats Targeting the Automotive Industry

The automotive industry faces increasing cybercrime threats that are impacting organizations throughout the sector. Understanding these risks is crucial for safeguarding assets and operations.

Fingerprinting threat actors by their anonymity techniques

Cybersecurity consultant Mick Deben of DMC Group created a knowledge base of attacker anonymity techniques for his master’s thesis. In this Studio 471 podcast, he discusses how practitioners can use it to fingerprint threat actors.

Threat Hunting Management Workshop: Structuring Collaboration Across Teams

Discover how better coordination across teams can increase the impact of your threat hunting program. Register now for our June 18 workshop and earn your Cross-Team Collaboration certificate.

Executive Brief: Cyber Threat Intelligence for C-Suite Strategic Goals

This Intel 471 paper is purposefully designed to assist senior business executives who increasingly instruct and influence CTI priorities according to findings from the survey.

The Business Value of Threat Hunting

Threat hunting has become indispensable for finding advanced criminal, nation-state, and state-backed threats that use popular techniques to evade detection.

SANS 2025 Threat Hunting Survey: Staged for Success

In this paper, we examine these major trends in detail, and explore how Intel 471’s HUNTER platform provides solutions to the issues presented.

Maximizing returns on cybersecurity investments with Intelligence-Driven Threat Hunting

This webinar offers security leaders and decision makers useful strategies to build a successful threat hunt program aligned with their corporate goals.

Managing a cyber crisis

In this Studio 471, Tom Bolitho of FTI Consulting shares how IT security incidents can be managed to minimize reputational damage.

Threat Hunting: Inmersión en Malware

Descubre cómo potenciar tu programa de CTI y mejorar tus defensas partiendo desde IOCs a implementar threat-hunting basado en comportamiento. Únete a Jorge Rodríguez, director de malware research en I

Threat Hunting Workshop 15: Hunting for Execution - Level 2

Sharpen your ability to detect malicious execution activity through hands-on threat hunting and intelligence-led analysis.

Guess Who: The Adversary Edition

This special edition episode of Out of the Woods: The Threat Hunting Podcast walks through a real-world threat actor activity one clue at a time, challenging listeners to analyze behavior, map tradecraft, and consider attribution as the activity unfolds.

SANS 2025 Threat Hunting Survey Report

The SANS 2025 Threat Hunting Survey: Advancements in Threat Hunting Amid AI and Cloud Challenges provides key insights and threat trends  to help you drive structured threat hunting processes and stay ahead of evolving adversary techniques.

Writing high-quality IDS detection rules

In this Studio 471, Jeremy Kirk sits down with Luca Allodi and Koen Teuwen of Eindhoven University of Technology who co-authored a recent academic study that examines how to write lower-noise rules for intrusion detection systems (IDSs).

Intel 471 Annual Threat Report 2024 & Outlook for 2025

The year 2024 has been marked by substantial disruptions and transformations within the underground cyber world, impacting both businesses and individuals. Our detailed report analyzes the evolving tactics of cybercriminals, the notable rise and fall of ransomware groups, and the ongoing challenges presented by emerging vulnerabilities. 

The evolution of Russian cybercrime

In this Studio 471, Roman Sannikov, Founder of Constellation Cyber shares his insight into the Russian cybercriminal landscape, the evolution of online crime and what lies ahead with ransomware.

Decoding the Ransomware Playbook: Threat Hunting Opportunities to Thwart Bassterlord’s Techniques

Join Intel 471 for our webinar “Decoding the Ransomware Playbook: Threat Hunting Opportunities to Thwart Bassterlord’s Techniques” to discover how your teams can use intelligence-driven threat hunting

From Skilled to Tactical Threat Hunting: Where to Focus for Maximum Impact

Top Cover 4 – Threat Hunting Management Workshop: Hiring Effective Threat Hunters

Intel 471's Top Cover workshop invites you to this session on hiring threat hunters, where we’ll explore strategies for building and managing a high-performing team.

NIS2: Achieving Digital Resilience Within Europe's Critical Sectors

This is a must-see webinar for all entities in scope of NIS2. Hosted by Intel 471 content manager Liam Tung, you’ll hear Dekker’s insights on how ENISA and the EU will help improve cybersecurity, resi

How threat actors are using artificial intelligence

Artificial intelligence is a red-hot mess, filled with contradicting predictions over whether it will bring vast benefits. In this Studio 471, Ashley Jess shares her insight into how AI will shape the threat landscape.

Threat Hunting Workshop 14: Hunting for Initial Access - Level 2

Intel 471 is excited to introduce the first in our new Level 2 Threat Hunting Workshop series, designed for those ready to take on greater challenges. This inaugural session focuses on Initial Access,

DORA: How Intelligence-Driven Security Strengthens Digital Resilience in the Financial Sector

New cyber security regulations like Europe’s Digital Operational Resilience Act (DORA), effective January 17, 2025, aim to enhance the financial sector’s resilience against cyber attacks and IT outages.

The Art of the Hunt: Turning Intel into Action

In this episode, "The Art of the Hunt: Turning Intel into Action," our expert team explores the nuances of threat intelligence, including behavioral and indicator-based approaches, and how to effectively leverage them for superior outcomes.

Collecting Useful CTI From Underground Markets

Extracting cyber threat intelligence on emerging threats and novel threat actors is challenging. Michele Campobasso completed his doctoral thesis in 2024 at Eindhoven University of Technology, and in Studio 471, he shares insights on these markets and maximizing CTI collection.

Happy Hunting | APT29

Using CTI in Realistic Attack Simulations

In this Studio 471, two experts from the cybersecurity consultancy CyberCX discuss how these exercises are developed and executed.

Lifting the Covers on RansomHub's Rise

RansomHub is now the top Ransomware-as-a-Service (RaaS) affiliate program since it hit the ransomware scene in February 2024. RansomHub claimed responsibility for 15% of over 1,000 ransomware breaches

Happy Hunting | PsExec

The Ideal Outcome: The Gift of a Well-Crafted Threat Hunt

In this episode, "The Ideal Outcome: The Gift of a Well-Crafted Threat Hunt", our expert team dives into what it means to reach the “ideal outcome” as a threat hunter, offering actionable insights to help you build an effective and enduring approach.

Happy Hunting | TURLA

Pink Slime Journalism and the 2024 U.S. Presidential Election Report

The rise "pink slime" news sites poses a significant threat to the integrity of online news and, by extension, to democracy itself. As both campaigns in the 2024 U.S. Presidential race began zeroing in on swing states, Intel 471 analysts surveyed some of the key organizations and people that color the pink slime landscape.

U.S. Elections 2024: What To Do About Pink Slime Overtaking Local News?

So-called “pink slime” news sites are filling an information void left by a U.S. local news industry in rapid decline. What can be done to control the integrity of online news in this environment? And

Will Processing CTI Become Legally Risky?

In this Studio 471, Peter Swire discusses the regulatory environment, how it could impact the use of cyber threat intelligence and what could be done to ensure attackers don’t leverage these changes to their advantage.

Threat Hunting Workshop 13: Hunting for Discovery - Level 1

Our workshop will unpack the intricacies of the Discovery tactic, exploring the methods adversaries use to identify sensitive information and map out environments. We'll dive into the most prevalent t

Threat Intelligence for NIS2 Ready Critical Infrastructure

Discover how Intel 471’s CTI solutions map to NIS2 risk management measures and reporting obligations in this Intel 471’s NIS2 Point of View report.

Happy Hunting | Berserk Bear

Happy Hunting | Mastering False Positives

NIS2 Operationalising Cyber Threat Intelligence for Critical Infrastructure Resiliency

This paper explores how entities in critical sectors can operationalise cyber threat intelligence (CTI) and intelligence-driven threat hunting practices to reduce cyber risk, anticipate threats, prioritise remediation of cloud resources and other IT assets, and continuously improve risk management measures to boost resilience and recovery.

Supercharge Your Security with Intelligence-Driven Threat Hunting

This whitepaper explores the core concepts of threat hunting and the effectiveness of intelligence-driven behavioral threat hunting programs. With HUNTER, security teams can scale their threat hunting efforts and enhance their defenses against evolving cyber threats.

Happy Hunting | AsyncRAT

Happy Hunting | Black Basta

Why Russia is a Hotbed of Cybercrime

In this Studio 471, Alec Jackson discusses how deep, institutional corruption ties Russian IT professionals, organized criminal groups and the state together and how Russia leverages this to its advantage.

Happy Hunting | TURLA

Blood, Sweat, and Threats: Carving the Perfect Threat Hunter

In this LIVE episode, “Blood, Sweat, and Threats: Carving the Perfect Threat Hunter,” we’ll explore the full journey of a threat hunter, from their first steps into the field to mastering the tools of the trade.

Frost & Sullivan Global Enabling Technology Leadership Award 2024

Frost & Sullivan assessed the cyber threat intelligence (CTI) industry and, based on its findings, recognizes Intel 471 with the 2024 Global Enabling Technology Leadership Award.

Happy Hunting | Indrik Spider

Happy Hunting | Unmasking APT38

Guests Check-in, Cybercriminals Cash-out: Protecting Payment Data from Phishing Attacks

In this webinar, you’ll learn how one cybercrime and fraud operation is targeting hotel guest payment card data in hotel booking systems. They’re not just abusing Booking.com’s brand in phishing email

Cyber Geopolitical Intelligence

Intel 471’s Cyber Geopolitical Intelligence provides a comprehensive view of current affairs to help assess digital risks and enhance security measures.

External Attack Surface Management: Intelligence-Driven Cybersecurity

Gain a deeper understanding of the significance of Cyber Threat Intelligence in External Attack Surface Management and learn about different methodologies and the benefits of CTI-led EASM, download our comprehensive whitepaper.

How to Comfortably Share Threat Intel with ISACs

In this Studio 471, Sydney Jones, Head of Threat Intelligence at CLS Group, discusses how she has set up several productive programs to share threat intelligence with Information Sharing and Analysis Centers (ISACs), helping the community reduce risk.

Threat Hunting Workshop 12: Hunting for Collection - Level 1

With Intel 471’s powerful in-depth cyber threat intelligence and HUNTER Platform, we will demonstrate how to effectively transition from intelligence to precise, operationalized threat hunting for col

Cybercrime Exposed Podcast: Tank

In 2006, a new type of malware appeared on the scene. Its name was Zeus. It was enormously profitable for its cybercriminal developers, who used it to steal tens of millions of dollars from businesses and organizations of all sizes.

CTI Capability Maturity Model (CTI-CMM) Handbook

Built by industry experts, the CTI Capability Maturity Model (CTI-CMM) can help your team build its capabilities and bridge the gap with stakeholders. Individuals from cross-organizational teams can use this Model to contribute to CTI program maturity.

How Cyber Insurance is Reducing Risk

In this Studio 471, Sezaneh Seymour, a vice president and head of regulatory risk and policy at Coalition, discusses how this approach is helping to reduce risk and incidents.

Threat Hunting Workshop 11: Hunting for Command and Control - Level 1

Our workshop will unpack the intricacies of command and control, exploring the methods adversaries employ to use this tactic. We'll explore the most prevalent techniques used for command and control a

Are They Who They Say They Are? An Introduction to Know-Your-Customer Fraud April 2024

Rapid digitalization and demand for online services have rendered Know-Your-Customer (KYC) identity verification processes a must for financial institutions and beyond to protect against fraud.

Happy Hunting | DarkGate Malware

What Can We Learn from Ransomware Attacks

In this Studio 471, Jamie MacColl, a research fellow with the Royal United Services Institute, discusses a recent study, “The Scourge of Ransomware Victim Insights on Harms to Individuals, Organisations and Society.” The study sought to understand the impacts of ransomware on multiple levels, from the IT people on the front line through to civil society.

Happy Hunting | FIN7

Happy Hunting | GootLoader Malware

MITRE ATT&CK Looks at Cybercrime Techniques

In this Studio 471, Patrick Howell O’Neill, who is a Lead Cyber Operations Analyst at MITRE, discusses cybercrime techniques and why ATT&CK is useful to security professionals.

Cyber Threat Report for the DACH Region

Financially motivated underground threat actors continue to impact entities in the DACH region.

The 471 Cyber Threat Report 2024

The 471 Cyber Threat Report 2024 highlights shifting adversary alliances, a global surge in ransomware and advancements in deepfake technologies among the top threat landscape trends.

Happy Hunting | Volt Typhoon

Happy Hunting | BlackCat Ransomware

Deepfake vs Democracy The Impact of Disinformation Campaigns on 2024 Election

AI tools could pose significant risk of amplifying political disinformation on a never-before-seen scale. This report provides insights into the current threat landscape, allowing for better preparation and protection against these emerging risks. 

Five Top Information Stealer Malware Families

This report offers a comprehensive analysis of five of the most popular infostealer families observed by Intel 471 across the reporting period from January 01 to December 01, 2023. 

SANS 2024 Threat Hunting Survey: Hunting for Normal Within Chaos

Discover the Cutting-Edge of Cybersecurity in the “SANS 2024 Threat Hunting Survey: Hunting for Normal Within Chaos”

Countering Cyber Extortion and Hacktivism

In this episode of Studio 471, we discuss two areas where Orange Cyberdefense has produced unique research in its Security Navigator 2024 report: cyber extortion and hacktivism. We tackle whether cyber extortion can be deterred and also the deeper effects of hacktivism, which can eclipse technical disruptions.

On the Money: The Top Cyber Threats to the Banking Industry Mar. 2024

Threat actors have the banking industry in their sights. The lucrative outcomes that a successful attack on an organization can provide and the industry’s growing digitization have created the perfect

Threat Hunting Workshop 10: Hunting for Initial Access - Level 1

Dive deep into the nuances of Initial Access, a critical area in the cybersecurity landscape. Our workshop will unpack the intricacies of this tactic, exploring the methods adversaries employ to escal

Cybercrime Exposed Podcast: Crypto Heist

In this podcast, we explore the story of Axie Infinity and examine how cyber attackers from North Korea managed to steal almost $600 million worth of virtual currency in just a few minutes, as well as how investigators were able to trace them.

Email Compromise to Network Threats: Advanced Methodologies in Threat Hunting

Banking and Securities Industry Threat Review

This report explores the top five threats to the banking and securities industry across 2023 to empower organizations with the knowledge they need to navigate the complex cyber threat landscape.

The Four Phases of Information Stealing Malware

This report covers a variety of distribution methods used by information stealers, including specialized installation services, malicious advertising (malvertising), search engine optimization (SEO) poisoning, and malicious spam (malspam).

Building Capable Threat Intelligence Programs

It's possible to build effective cyber threat intelligence programs with smaller teams, but stakeholder buy-in is important. John Fokker of Trellix describes how security teams can improve their CTI programs.

Keys to the Kingdom: An Analysis of Ransomware and Access Trends in 2023 Feb. 2024

Ransomware deployments are increasing each year, and so are the sophistication of the attacks. Without initial access to an organization, these attacks would not be possible. In today’s highly digital

Unmasking Threats Impacting the Aerospace and Defense Industry

This report provides an overview of critical threats impacting the Aerospace and Defense landscape and analyzes common attack vectors and tactics, techniques, and procedures (TTPs) utilized by threat actors targeting these industries.

Cybercrime Exposed Podcast: Botnet Breakup

The Qakbot or QBot botnet was used by cybercriminal gangs to infiltrate computers, steal their data, conduct financial crime and deploy ransomware. But in 2023, law enforcement hacked the hackers. Here's the story.

Cyber Threat Health Check Report

Malicious cybercriminals frequently target the pharmaceutical, biotechnology, and life sciences sectors. Companies in these sectors must remain vigilant and take the necessary measures to protect their valuable assets.

Testing the Efficacy of Security Software

In this edition of Studio 471, Simon Edwards of SE Labs walks through how his company tests security products based on the cyber kill chain and MITRE ATT&CK.

Crashing the Party: How to Leverage CTI to Mitigate Supply Chain Risk Jan. 2024

As supply chains have increased in complexity and interconnectivity, so too have operational demands for digital solutions to monitor and manage them more efficiently. In tandem with these development

Threat Hunting Workshop 9: Hunting for Privilege Escalation - Level 1

Get ready to elevate your threat hunting skills with Intel 471's exhilarating and interactive workshop, focusing on the pivotal MITRE ATT&CK Tactic: Privilege Escalation. This isn't just another works

Beyond Detection: Mastering Proactive Threat Hunting Strategies

Leverage CTI to Mitigate Supply Chain Risk

This whitepaper provides an understanding of the who, what, and why behind supply chain attacks, empowering organizations to avoid these incidents in the future.

Cybercrime Exposed Podcast: The Xbox One Hack

In the early 2010s, a group of malicious hackers had a goal: to build a Durango, which was the code name for Microsoft’s next-generation gaming console, eventually known as the Xbox One.

Vulnerability Management and Patching: Outrunning Attackers

In this edition of Studio 471, Patrick Garrity of Nucleus Security shares the effects of the KEV list across the security industry, his research into the KEV, and how threat intelligence can guide patching efforts.

Malware 101: Power up your investigations; Protect your organization. Dec. 2023

Malware attacks continue to increase in velocity and sophistication. No industry is safe from being targeted by the threat actors driving them. Invaluable insights and details about a cyber incident c

The Underground Carding Market

Payment card fraud remains a significant threat in the underground marketplace. Intel 471 details threats such as social engineering, information-stealer malware, and compromised databases that assist in perpetuating the threat from the carding market.

Navigating Threat Hunting: Community Insights, Effective Tools, and the Role of Honeypots

Cybercrime Exposed Podcast: Social Engineering

In this episode of Cybercrime Exposed, Bluma Janowitz, a social engineer and red team agent, describes two of her engagements to test an organization’s defenses against malicious hackers.

Mandiant’s CTO: A Bad Year for Ransomware and Extortion

In this edition of Studio 471, Mandiant CTO Charles Carmakal says half of all ransomware or extortion victims are paying ransoms. Sometimes, that is to prevent the release of sensitive data, while others pay to speed up recovery – even if the organizations have backups.

Bulletproof Hosting Landscape: Status Update on Actor yalishanda

Intel 471 has been actively tracking Bulletproof Hosting (BPH) services and the threat actors behind them. One threat actor notably continues to provide one of the most popular malicious infrastructure services: yalishanda.

Mobile Malware Underground Perspective

This report discusses how mobile malware impacts Android devices from the perspective of cybercriminals and financially motivated threat actors. Get a deeper understanding of mobile malware attacks by downloading our whitepaper.

Cybercrime Exposed Podcast: The Extortionists

In one long weekend in May 2023, a cybercriminal gang called Clop conducted one of the largest data breaches on record.

Should Ransom Payments Be Made Illegal?

In this edition of Studio 471, Megan discusses the future of the Ransomware Task Force, whether ransom payments should be banned and how organizations are strengthening baseline security.

Bypassing With Bots: How Adversaries Use Automated Services to Sidestep OTPs Oct. 2023

Not all passwords are created equal. They may range from silly to scure, but one thing they have in common is that they’re the gateway into sensitive information. The good news is that tools like mult

Gaining the Advantage with Covert Cyber HUMINT

Delve deep into the world of Cyber Human Intelligence (HUMINT) — where traditional human intelligence meets the digital world. Discover the strengths, challenges, and best practices to arm your organization with advanced, holistic defense strategies.

Cybercrime Exposed Podcast: The Phisherman

In this episode of Cybercrime Exposed, Bex Nitert, an incident response and forensics professional in Australia describes herself as a digital firefighter who helps organizations after they’ve been hacked. She often investigates phishing, the term for stealing login credentials with the aim of taking over accounts and systems.

Deep Dive into DNS Twisting, Cyber Insurance, and Conference Optimization

Why Ransomware is Stubbornly Sticking Around

In this edition of Studio 471, Jacqueline Burns Koven of Chainalysis discusses how ransomware is evolving and what challenges it poses for defenders.

Q2 Ransomware 2023: Reviewing Third-Party Risk Sept. 2023

Join Intel 471’s webinar as we shine a spotlight onto increasing ransomware attacks.

Interactive Threat Hunting: Exploring Vegas Ransomware, Generative AI Scams, and Advanced Defense Strategies

Threat Hunting Insights: Analyzing SIEM vs EDR, CIS Controls, and Advanced Techniques

Know Your Adversaries and Where They Trade, To Stop Cyber Attacks Aug. 2023

In this webinar we will show you how tracking adversaries and the tools they use can help you stay ahead of threats like ransomware and third party risk. We will demonstrate this using real world exam

Busting a Myth: Overlap Between Nation State & Financially Motivated Cybercrime

In this webinar, you'll discover the undeniable link between Nation-State and Financially Motivated cybercrime.

Using Intel 471 Intelligence to Prevent Ransomware Attacks

This webinar looks into the cyber underground and shows how you can identify precursors for a ransomware attack to orient your defenses and stay one step ahead of your adversaries.

7 Habits of Cybercriminals

This webinar presents the results of an analysis of more than 12 years of tracking and reporting on a variety of actors and groups in the cyber underground, which allowed us to identify seven specific

Bottom Feeders: Initial Access Broker Activity Examined

Learn about initial access offerings in the cyber underground and gain insights into the activity patterns of the most prominent IABs.

Four Ways the Cyber Underground is like the Middle Ages

In many ways, the cyber underground strongly resembles Medieval Italy or the Wild West. This webinar discusses how to increase your cyber protection by learning from history.

How a CTI Framework Catapults Your Cyber Security Program

Join us for a discussion on how to build the right CTI Framework, fueled by General Intelligence Requirements (GIRs), to help you elevate your cyber defense and catapult your cybersecurity program to

Ransomware: Attackers vs Defenders

Join us as our presenters use Intel 471's knowledge of the underground and Unit 42's experience with ransomware incident response cases to reveal how threat actors find their victims, gain e

Ransomware Dramas Why Focusing On Ransomware Itself is Not Enough

In this session, we look at the ecosystem that aids in the deployment of ransomware as well as the key actors and steps involved in a typical attack

Sidestepping a Cyber Car Crash in Matrix Time

Ransomware is like a slow-moving car crash. Incidents don't occur in an instant. The cyber underground is ripe with indicators that can predict an attack weeks or months before the event occurs.

Using A Data Driven Approach to Defend Against Cyber Threats

Learn from CLEAR, Intel 471, and ThreatQuotient professionals, who share their tactical and strategic experience regarding how cybersecurity professionals have successfully addressed similar challenge

The 471 Cyber Threat Report 2023

This report analyzes the key trends that are gaining or losing momentum and predicts how they will shape cybercrime and the cyber underground in the coming year.

Stopping the Reuse of Credentials and Session Tokens

Brett Winterford of Okta and Intel 471’s Jeremy Kirk discuss strong authentication, paths to strengthening authentication and what Intel 471 analysts are observing around credential theft in the cybercriminal underground.

AI: Ready for Underground Prime Time? July 2023

Ever since the introduction of ChatGPT, Artificial Intelligence (AI) has remained in the spotlight, captivating businesses and the global community as they strive to comprehend the potential of this g

Shot of Cyber with Mark Arena

Gilad and Simon sit down for a chat with Mark Arena, founder and former CEO of Intel471. We discuss his incredible trajectory, the birth of Intel471, and what it’s like competing and growing a bootstrapped business. We discuss the importance of proactively building and enforcing a culture, especially when it hurts.

Oil, Gas, Energy Cyber Threats

Cyber threats targeting critical national infrastructure (CNI) are becoming increasingly common.

Threat Hunting: Shifting Gears in Query Tuning

In this informative session, we will guide you through the winding roads of query tuning, mapping out the 'why', 'what', and 'how' of the process.

Mont4na Actor Profile

Intel 471 has monitored Mont4na, a well-known underground actor who has been active on forums since November 2020.

Threat Hunting Workshop 8: Hunting for Exfiltration - Level 1

Are you ready to take your threat hunting skills to the next level and become an expert in the MITRE ATT&CK Tactic of Exfiltration (TA0010)?

Mastering Cybersecurity: Exploring White Space, Tierless SOCs, and the Future of AI in Management

Top Cover - Threat Hunting Management Workshop: Reporting & Communication

Join us for a unique interactive threat hunting management workshop where Intel 471's Senior Threat Hunter, Scott Poley, will guide you through the crucial skill of writing effective threat hunti

RSAC Fireside Chat: How timely intel from the cyber underground improves counter measures

In this RSAC Fireside Chat, Jason Passwaters, CEO of Intel 471, joins Byron V. Acohido for an enlightening discussion on leveraging timely intelligence from the cyber underground to bolster countermeasures.

Threat Hunting Workshop 7: Hunting for Impact - Level 1

In this immersive, educational, and fun workshop, Intel 471's expert instructors will guide you through the critical areas of impact, including the mechanics of impact and the most common tactics, tec

Top Cover - Threat Hunting Management Workshop: From KPIs to Metrics

Join us for a unique interactive threat hunting management workshop where Intel 471's Senior Threat Hunter, Scott Poley, will guide you through the critical aspect of managing a threat hunting pr

Hybrid Hunting: Threat Hunting in the Managed Security Battlespace

Join our expert speakers, Scott Poley (Senior Threat Hunter, Intel 471y) and Justin Heard (Threat Intelligence Manager, Nuspire) for a comprehensive overview of the latest trends in hybrid hunting and

Cyber Chronicles: Live Threat Hunting, Security Insights, and Community Collaboration

Top Cover: The Threat Hunting Management Workshop

Join us for a unique interactive threat hunting management workshop where Intel 471's Director of Threat Research, Brandon Denker, will guide you through the critical aspect of managing a threat

Navigating Cybersecurity Challenges: Insights from Mistakes and Innovations

Threat Hunting Workshop 6: Hunting for Lateral Movement - Level 1

Join Intel 471's expert threat hunters as they dive into the interesting MITRE ATT&CK Tactic of Lateral Movement (TA0008).

Year in Review 2022

The year of 2022 presented both new and evolving trends.

Exploring Cybersecurity with ChatGPT: From Threat Hunting to System Configurations

Germany Cyber Threats

A significant number of businesses in Germany continue to be impacted by cybercrime each year, leading to substantial operational downtime and monetary loss.

Cybersecurity Essentials: Addressing BYOD Risks, Human Simulations, and Professional Development

Threat Hunting Workshop 5: Hunting for Credential Access - Level 1

Join Intel 471's expert threat hunters as they dive into the interesting MITRE ATT&CK Tactic of Credential Access (TA0006).

Enhancing Cyber Resilience: Cloud Risks, Vulnerability Management, Home Labs, and Overcoming Imposter Syndrome

Gaming Cyber Threats

The scope of analysis performed in this report provides a strategic-level overview of observed and potential threats to the gaming industry.

UK Cyber Threats

This report provides a strategic-level overview of threats identified impacting the U.K. and U.K. based businesses, including ransomware and initial access brokers (IABs), as well as common threat actor tactics, techniques and procedures (TTPs) observed.

Threat Hunting Workshop 4: Hunting for Defense Evasion - Level 1

Join Intel 471's expert threat hunters as they dive into the interesting MITRE ATT&CK Tactic of Defense Evasion (TA0005).

Empowering Security Teams: Innovative Logging, Red vs Blue Team Benefits, and Effective Table Tops

Leading Ransomware Variants Q3 2022

This report examines the leading ransomware variants related events for Q3 2022 specifically observed by Intel 471.

Threat Hunting Workshop 3: Hunting for Execution - Level 1

Join Intel 471's expert threat hunters as they dive into the interesting MITRE ATT&CK Tactic of Execution (TA0002).

Ransomware's Future: A Continuing Money Spinner

Intel 471's Michael DeBolt Says Anti-Ransomware Actions Will Take Time

Optimizing Threat Hunting: Personal and Environmental Management

Rise of Black Basta Ransomware

This report uses the analytical technique known as strengths, weaknesses, opportunities, and threats (SWOT) analysis to conduct an assessment of the Black Basta ransomware group.

Crashing the Party: Leverage Threat Intelligence to Mitigate Third Party Risk

Learn how cyber threat intelligence has helped to safeguard organizations like yours from third party risk.

Using Cyber Frameworks to Action CTI and Enhance Your Security Posture

Learn how NIST, MITRE ATT&CK™ and other cyber frameworks can better leverage your threat intelligence and improve your security posture.

The 471 Cyber Threat Report: 2022-2023 Trends & Predictions

Intel 471 has identified a number of cyber threat trends that will likely dominate the landscape in 2023 and beyond.

Connecting Threat Hunters: From Tactical Insights to Strategic Defense

Decipher Security Podcast: Mark Arena

Mark Arena, CEO of Intel 471, joins the Decipher podcast to talk about the journey behind founding Intel 471 in 2014 and how cybercrime has evolved over the past few years.

Dispatches from Somewhere Else

Join our Hunt Team, featuring Scott Poley from Intel 471, and Richard “Chit” Chitamitre from Corelight, for a fun, technical, and in-depth hunting session to pursue the adversary, identify their tacti

Commonly Observed Threats to Telecommunications Sector

This report examines threats posing exponential risk to the telecommunications sector observed by Intel 471.

Cybercrime and punishment - The CyberWire

Our guest is Michael DeBolt of Intel 471 on the growing interest in Biometrics in the criminal underground. And cybercrime and punishment, Florida-man edition.

Bulletproof Hosting Services and Cybercrime: Yalishanda Case Study

Intel 471 closely monitors numerous BPH operations, but one has grown in popularity across the underground, Yalishanda.

Initial Access Offers, Ransomware Incidents

Purchasing access to organizations allows threat actors to reduce the time it takes to enter an environment. In 2021, the average time between a network access offer and a ransomware-as-a-service (RaaS) affiliate program breaching the same entity was 71 days.

Michael DeBolt: From acting to cyber [Intelligence] - The CyberWire

Chief intelligence officer at Intel 471, Michael shares his story where he started as an actor and quickly changed over to intelligence and what the transition was like for him.

A popular malware scheme and pay-per-install services - The CyberWire

Guest Michael DeBolt from Intel 471 joins Dave Bittner on this episode to discuss one of the most popular commodity malware loaders on the underground – PrivateLoader.

Threat Hunting Workshop 2: Persistence is Futile - Level 1

Join our team of threat hunting instructors for a unique and immersive threat hunting workshop.

Hunting for CONTI: TTPs Not IOCs

Join Intel 471's Scott Poley as he goes into a live threat hunt for the Conti ransomware using the latest threat intelligence reporting, and the very real pitfalls organizations face in trying to

The Threat Hunter’s Hypothesis

A case for structured threat hunting and how to make it work in the real world.

Ransomware Variants Q4 2021

This report examines the leading ransomware variants related events for Q4 2021 specifically observed by Intel 471.

Thinking Like a Threat Actor: Hunting the Ghost in the Machine

This webinar will demonstrate how organizations can overcome these internal blind spots, and hunt adversaries in real time across their network using telemetry from tools like NDR when coupled with ED

Overview of Cyber Threat Trends to Beware of in 2022

Cybersecurity increasingly has become a priority for organizations across all sectors as technology continues to advance worldwide. This report aims to provide a high-level overview of these threats, which likely will remain prevalent and worthy of continued focus throughout 2022.

Threat Actors Looking for a Steal: Key Threats Impacting the Retail Industry

The retail industry is a highly targeted vertical, a trend Intel 471 assesses is certain to continue since defrauding retailers remains a lucrative pursuit for financially motivated threat actors.

Threat Hunt Deep Dives Ep. 10 - Get to Know Your Logs Pt. 2

Arrests in a cryptocurrency money-laundering case. - The CyberWire

Our guest is Greg Otto from Intel 471 to discuss shifts in ransomware strains. And two arrests are made in a money-laundering case connected with the Bitfinex hack.

Begin Your Hunt: The Threat Hunting Workshop

That is why Intel 471 is offering a first-of-its-kind interactive threat hunting workshop where anyone can learn how to threat hunt in a safe, fun, and dynamic environment!

Log4j Vulnerability Situation Report

This report aims to provide you with a consolidated update of all of our findings regarding the Log4j aka Log4Shell vulnerability, tracked as CVE-2021-44228, up to December 16, 2021.

Threat Hunt Deep Dives Ep. 9 - Get to Know Your Logs Pt. 1

Brand Protection in Healthcare in Times of COVID-19

Good grammar is essential for business email compromise. - The CyberWire

Guest Brandon Hoffman from Intel 471 is back sharing some research on business email compromise,

The Callback is Coming From Inside the House!

This webinar will demonstrate how threat hunting with EDR and NDR combined allows organizations to find what traditional security controls keep missing. It is guaranteed to terrify CISOs everywhere be

Threat Hunt Deep Dives Ep. 8 - Living Off the Land (LOTL) with Esentutl.exe

The Online Criminal Underground: Cybersecurity and Corporate Threats

Greg Otto, Chief Cybercrime Reporter at Intel 471 discusses prevention methods as well as how international agencies, businesses, the federal government, and insurance companies are working diligently to protect their own interests as well as our data

Public Sector Threat Briefing

Do You Even Threat Hunt, Bro? Hunting for WMIC Abuse

Join one of Intel 471's lead threat hunters, Scott Poley, as he demonstrates a technique used by adversaries and cyber criminals alike, by abusing WMIC to copy and execute payloads on remote endp

Media & Telecommunications Threat Briefing

Industrial & Manufacturing Threat Briefing

Do You Even Threat Hunt, Bro? Hunting For HiveNightmare (CVE-2021-36934)

Join one Intel 471's lead threat hunters, Lee Archinal, as he demonstrates hands-on practical session of true behaviorally-based threat hunting related to the vulnerability known as HiveNightmare

Companies don't want their customers to be victims of fraud.

Guest Brandon Hoffman from Intel 471 joins Dave to talk about how cybercriminals are going after large retail and hospitality companies, Joe shares some advice for college students to avoid scams and ID theft, Dave's got an edit to the tale of the lightning rod, our Catch of the Day comes from listener Shannon who received a beneficiary scam email.

T-Mobile outlines what it’s offering customers hit by its data breach

Our guest is Brandon Hoffman from Intel 471 on cybercriminals creating turbulence for the transportation industry. And a Bitcoin tumbler cops a guilty plea.

Using Cyber Underground & Blockchain Intel to Stop Cyber Attacks

Cyber Threats: The Next Hurdle for Retail & Hospitality

Easily Enrich Your Investigations with Maltego & Intel 471

French Threat Landscape Update

Patching Intelligence with Intel 471 & ThreatQuotient

Transportation Industry Cybercrime Collision

451 Research Publishes Intel 471 Report

Intel 471 analysis identifies the most useful among forums and venues of greatest relevance to cyberthreats affecting its clients.

A cyber most-wanted list. Are the phone lines open? - The CyberWire

Our guest is Brandon Hoffman of Intel471 with insights on China’s data underground. And, hey, it’s Dmitri from Yurga, long-time listener, first-time caller.

Shining Light on the DarkSide - Part 3

Join us for an interactive and lively panel discussion featuring Dave Amsler of Intel 471, Anuj Goel of Cyware, and Jim Linn of the American Gas Association as they discuss the short and long term eff

Cybersecurity, Ransomware, and the NATO Summit

In this panel of former military personnel turned cybersecurity experts, we discuss the state of cybersecurity, ransomware, and the NATO Summit.

Shining Light on the DarkSide - Part 2: Uncut

Prepare for an in-depth and uncut technical deep dive with Intel 471's Austin Jackson, into the actors' tools and TTPs and how organizations can hunt and detect them in their own environment

Advice for military leavers transitioning to cyber security careers | Jason Passwaters (Intel 471)

This episode with Jason Passwaters (COO & Co-Founder, Intel 471) is aimed at military leavers, how to best prepare for the transition and the lessons learnt from Jason's experience.

Threat Hunt Deep Dives Ep. 7 - User Account Control Bypass Via Registry Modification

Shining a Light on the DarkSide - Part 1

Join Intel 471's Brandon Denker and Mike Mitchell as they provide insight into the attack against the Colonial Pipeline, and suggest strategies for earlier detection through threat hunting.

EtterSilent: a popular, versatile maldoc builder. - The CyberWire

Guest Brandon Hoffman of Intel 471 joins Dave Bittner to share his team's research & EtterSilent: the underground’s new favorite maldoc builder.

Collaboration between network access brokers and ransomware actors deepens

In this Help Net Security podcast, Brandon Hoffman, CISO at Intel 471, discusses about the increased collaboration between network access brokers (NAB) and ransomware operators, and how they funcion it today’s threat landscape.

Cobalt Strike - A Toolkit for Pentesters Whitepaper

The cybercrime underground’s adoption of Cobalt Strike correlates with the rise in ransomware activity over the past few years.

Thinking Like a Threat Actor: Cross Platform Hunting for Persistence

Prepare for an in-depth, uncut, and interactive technical deep dive into persistence. Join Cyborg Security's Austin Jackson as he demonstrates various advanced persistence mechanisms in Windows,

Frost & Sullivan 2021 Customer Value Leadership Award Intel 471

For its strong overall performance, Intel 471 is recognized with Frost & Sullivan’s 2021 Customer Value Leadership Award.

Cybersecurity – Military Appreciation Month

Cybersecurity has long been a part of the job description for these former servicemen. This Military Appreciation Month we talked with J.C. Vega, Jason Passwaters, and Barett Darnell about how their military experiences and skillsets transferred into the world of cybersecurity.

Americas Threat Landscape Update

Benelux Threat Landscape Update

Intel 471 & Silobreaker APAC Threat Landscape Update

Middle East Threat Landscape Update

Middle East Threat Landscape Update

Nordics Threat Landscape Update

Spain Threat Landscape Update

Financial Services Threat Landscape Update

Join us in this webinar focusing on threats to the financial industry as Maurits Lucas, Director of Intelligence Solutions at Intel 471, looks at the after-effects in the underground of disruption ope

Bulletproof hosting (BPH) and how it powers cybercrime - The CyberWire

Guest Jason Passwaters of Intel 471 joins us to discuss his team's research into bulletproof hosting (BPH). The research team at Intel 471 defined what a typical BPH service offers and how these services can be stopped in order to limit the damage they have on enterprises, businesses and digital society itself.

Threats Persist Against Financial Services Sector: Products, Goods, Services Continue to Fuel Attack Schemes

The financial services sector continues to garner serious interest from underground threat actors, and it is unlikely to change during the following year.

The benefits of cyber threat intelligence

In this Help Net Security podcast, Maurits Lucas, Director of Intelligence Solutions at Intel 471, discusses the benefits of cyber threat intelligence. He also talks about how Intel 471 approaches adversary and malware intelligence.

Thinking Like a Threat Actor: Structured vs Unstructured Threat Hunting

Threat hunting is one of the most powerful capabilities an organization can have. It enables identification of new and emerging threats in an environment. Often long before other more reactive securit

Leveraging Intel 471’s Malware Intelligence Data Using MISP Whitepaper

Using Intel 471’s Malware Intelligence with MISP provides clients with constant coverage of top-tier malware families.

Threat Hunt Deep Dives Ep. 6 - Living off the Land (LotL) Pt. 2, RDP Hijacking with Tscon.exe

Threat Hunting Framework

The Threat Hunting Framework lays out an operationalized methodology that organizations can use to begin threat hunting today.

Threat Hunt Deep Dives Ep. 5 - Living off the Land (LotL) - Downloading Files on Microsoft Windows

Mobile Malware - Underground Perspective Whitepaper

As customers shifted to mobile banking, the focus of mobile malware also changed. Threat actors began to execute attacks on the infected device using overlays to phish data and two-factor authentication (2FA) tokens from victims.

Threat Hunt Deep Dives Ep. 4 - Apache Struts RCE (CVE-2020-17530)

Threat Hunt Deep Dives Ep. 3 - SolarWinds Supply Chain Compromise (Solorigate / SUNBURST Backdoor)

Threat Hunt Deep Dives Ep. 2 - Application Shimming

Government Censorship, Surveillance Influence Chinese Cybercrime Underground Whitepaper

The underground marketplace functions like any other marketplace, including buyers and sellers with fluctuating supply and demand for different products and services.

Black Hat Webcast Series | Practical Threat Hunting

Threat Hunt Deep Dives Ep. 1 - The Return of the WIZard

The Content Revolution

Quality threat content can make or break threat hunting and detection efforts.

Validating Your Detections With Red Canary’s Atomic Red Team and Cyborg’s Cyber Threat Emulation

Overcoming the Challenges of Cyber Threat Hunting with Contextualized Content

Modern enterprises must proactively seek out the most dangerous cyber adversaries lurking in their networks today as those are the ones that cause the real or significant damage and loss to organizations.

Is Your Threat Hunting Effective?

In this paper, we explore in more depth what exactly leads to the shortage of suitable personnel and how it affects security organizations’ capabilities to utilize threat hunting teams.

The 5 Traits of Effective Threat Intelligence

Threat intelligence, often referred to as cyber threat intelligence (CTI) or more simply, intelligence, can be a controversial subject.

Adversary Intelligence

Intel 471's Adversary Intelligence provides proactive and groundbreaking insights into the methodology of top-tier cybercriminals.

Malware Intelligence

Intel 471 Malware Intelligence allows you to actively track weaponized and productionized threats.

Attack Surface Protection

Intel 471’s Attack Surface Protection is our suite of solutions, each geared for different users at different stages in their attack surface journey.

Cyber Geopolitical Intelligence

Cyber Geopolitical Intelligence from Intel 471 provides a unique lens to organizational leaders about shifting regional alliances, trade disputes, territorial conflicts and diplomatic crises that we believe will impact the cyber threat landscape.

HUNTER Guided Threat Hunts

Intel 471 HUNTER Guided Threat Hunts helps your threat hunters overcome these obstacles so your team can quickly find, neutralize, and report undetected threats.With the preview launch of Guided Threat Hunts, HUNTER now offers a Pivot Queries library for HUNTER hunt packages that helps hunters pivot on query result data and progress their hunt for adversary behaviors.

The Hunt Management Module

Threat hunt teams need tooling to manage hunt processes and ensure that hunt outcomes drive proactive security operations. The Hunt Management Module guides the management of hunts, including research, testing, results, and reporting, helping teams develop consistent, rigorous, and repeatable processes that improve the organization’s security posture, controls, and policies.

Marketplace Intelligence

Intel 471 Marketplace Intelligence offers insights into the most important and active underground marketplaces.

Cybercrime Intelligence

Intel 471's Cybercrime Intelligence provides proactive and groundbreaking insights into the methodology of top-tier cybercriminals - target selection, assets and tools used, associates and other enablers that support them.

Vulnerability Intelligence

Intel 471’s Vulnerability Intelligence provides both relevant and timely intelligence information about the adversary.

Behavioral Threat Hunting

Behavioral threat hunting uses security event data to identify patterns of behavior based on adversary intelligence that reveal a specific actor’s tactics, techniques, and procedures (TTPs) inside an environment. By studying how specific threat actors have used tools, systems, and software to achieve their goals, threat hunters can identify expected behaviors within the “cyber kill chain” that indicate network pivoting, expansion or exfiltration.

Credential Intelligence

Intel 471’s Credential Intelligence provides complete coverage across the underground marketplace.