1/ Today @milenkowski.bsky.social from @sentinellabs.bsky.social and I are publishing a project we've been working on over the past few months. We found suspected China- and India-linked espionage actors independently targeting the same victim: #Balochistan Police in #Pakistan. s1.ai/spy2flags

Colleagues of mine at Insikt Group just released new research on the Iran-nexus cluster #TAG-182, deploying #MarkiRAT, a malware family previously observed in use by #FerociousKitten, for internal and external surveillance: www.recordedfuture.com/research/nex...

Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool

Discover how Iranian-nexus threat cluster TAG-182 uses MarkiRAT malware and fake VPN/media apps to conduct cyber surveillance operations against domestic targets.

recordedfuture.com

In August 2025, @whoisnt.bsky.social and I documented how Stark Industries evaded EU sanctions. This week, Dutch authorities arrested two individuals and seized hundreds of servers linked to WorkTitans BV in an investigation into sanctions evasion. www.volkskrant.nl/binnenland/h...

New from Recorded Future! @whoisnt.bsky.social and I break down Threat Activity Enablers (TAEs), the often overlooked backbone of modern cyber operations. 🔗 www.recordedfuture.com/blog/threat-...

Great analysis on administrative activity in the leaked Media Land dataset disclosing.observer/2026/04/29/h...

Looking forward to presenting at @pivotcon.bsky.social in Malaga later on this week. So excited to see everyone and dive into the exceptional agenda!

PIVOTcon@pivotcon.bsky.social · 5mo ago

"A 'Fishy' Conference in Autumn" Julian-Ferdinand Vögele @julianferdinand.bsky.social , Principal Threat Researcher at Recorded Future's Insikt Group 7/15

🧵 ICYMI: We just dropped our 2025 Malicious Infrastructure Review! Some of the highlights below👇 #Infosec #CyberThreats 1/6 www.recordedfuture.com/research/202...

-Iran internet outage not caused by strikes -Russia expands internet blackout to Sankt Petersburg -Oracle out-of-band security update -Himmelblau vulnerability gives root -Claudy Day vulnerabilities -Leak in German uni campuses platform -Langflow attacks started within a day

Microsoft defender is also flagging #TheVoidStealer as #WallStealer. Here’s the threat actor nikoniko (aka “TheVoidStl”) discussing the removal of multiple detections, including WallStealer.

Catalin Cimpanu@campuscodi.risky.biz · 5mo ago

Gen Digital has spotted the VoidStealer infostealer using a new method to bypass Chrome's credentials encryption system to steal passwords and cookies www.gendigital.com/blog/insight...

Recorded Future's annual malicious infrastructure report has finally dropped, and this year, we took a different approach to how we analyze malicious infrastructure👇

Julian-Ferdinand Vögele@julianferdinand.bsky.social · 5mo ago

11/ To address network size based biases, in 2025 we focused on TAEs using Recorded Future’s Threat Density model, identifying networks disproportionately linked to malicious activity relative to their size.

1/ Today we’re publishing our annual malicious infrastructure report, providing a broad view of global threat infrastructure. This year, we significantly expanded coverage across malware families, threat categories, and deeper infrastructure insights: www.recordedfuture.com/research/202...

2025 Year in Review: Malicious, Infrastructure

Explore Insikt Group’s 2025 Malicious Infrastructure Report. Gain insights into Cobalt Strike, Vidar infostealers, and AI-driven threats to secure your 2026 strategy.

recordedfuture.com

Noticed Microsoft Defender tagging #TheVoidStealer as #WallStealer thanks to some recent abuse_ch uploads. Here’s the threat actor nikoniko (aka “TheVoidStl”) discussing the removal of multiple detections, including WallStealer.

-Even more research on Twitter/X algorithm manipulation -Russia turns on Telegram -Texas sues TP-Link -West Virginia sues Apple -US does dumb things, part 332737232 -Spain arrests hotel hacker -Nigerian hacker sentenced to 8 years -651 cybercrime arrests in Africa -GrayCharlie profile

1/ Today, Insikt Group is publishing on GrayCharlie, a threat actor active since mid-2023 that overlaps with SmartApeSG. GrayCharlie compromises WordPress sites and turns them into malware delivery hubs: www.recordedfuture.com/research/gra...

GrayCharlie Hijacks Law Firm Sites in Suspected Supply-Chain Attack

GrayCharlie turns compromised WordPress sites into malware delivery machines. Discover how this threat actor chains fake browser updates and ClickFix lures to deploy NetSupport RAT, Stealc, and Sectop...

recordedfuture.com

CastleLoader in the wild! Four distinct activity clusters, sector-specific targeting of logistics, and high-end tooling like Matanbuchus and CastleRAT.

Julian-Ferdinand Vögele@julianferdinand.bsky.social · 8mo ago

1/ @whoisnt.bsky.social, Marius, and I just published a report on #GrayBravo (formerly TAG-150), a highly adaptive, sophisticated threat actor that we first identified in Sept 2025. It uses a multi-layered infrastructure and responds quickly to exposure: www.recordedfuture.com/research/gra...

Recorded Future’s Insikt Group uncovered four GrayBravo activity clusters. TAG-160 impersonates logistics firms, while TAG-161 impersonates Booking.com, employing ClickFix to deliver CastleLoader and Matanbuchus. www.recordedfuture.com/research/gra...

2/ Our latest analysis uncovered four distinct activity clusters within GrayBravo’s ecosystem, all leveraging the group’s #CastleLoader malware. Each cluster uses different tactics, techniques, and targets, reinforcing the assessment that GrayBravo runs a #MaaS model.

1/ @whoisnt.bsky.social, Marius, and I just published a report on #GrayBravo (formerly TAG-150), a highly adaptive, sophisticated threat actor that we first identified in Sept 2025. It uses a multi-layered infrastructure and responds quickly to exposure: www.recordedfuture.com/research/gra...

GrayBravo’s CastleLoader Activity Clusters Target Multiple Industries

recordedfuture.com

A good piece highlighting the EU's continued inaction following recent sanctions, essentially allowing these enablers to continue their operations.

VSquare.org@vsquare.bsky.social · 8mo ago

🕵️ Aéza, linked to the pro-Kremlin Doppelganger disinfo network, has been sanctioned by the US, Australia, and the UK for aiding cybercriminals. The EU, however, has taken no action. @vsquare.bsky.social @investigacecz.bsky.social

The Predator spyware from surveillance company Intellexa has been using a zero-click infection mechanism dubbed "Aladdin" that compromised specific targets when simply viewing a malicious advertisement.

Predator spyware uses new infection vector for zero-click attacks

The Predator spyware from surveillance company Intellexa has been using a zero-click infection mechanism dubbed "Aladdin" that compromised specific targets when simply viewing a malicious advertisement.

bleepingcomputer.com

🚨 - New report by Haaretz, Inside Story, Inside-IT and Amnesty International release the Intellexa Leaks. Which exposes Intellexa support staff had access through Teamviewer to customer deployments and confirms found IOC's in the past by civil society. 🧵👇

1/ Today we release a new report exposing previously undisclosed entities connected to the wider #Intellexa ecosystem as well as newly identified activity clusters in Iraq and indications of activity in Pakistan: www.recordedfuture.com/research/int...

Intellexa’s Global Corporate Web

recordedfuture.com

1/ It's nice to see the topic of bulletproof hosters and Threat Activity Enablers gaining more mainstream attention; however, a bigger problem than endless shell companies exists, and that is RIPE RIR policy. bindinghook.com/neutral-inte...

‘Neutral’ internet governance enables sanctions evasion

Internet service providers and hosting companies enable cybercrime and cyber operations. Why don’t sanctions stop them?

bindinghook.com

The national cyber director and a top FBI official shared more details about the forthcoming Trump administration document Tuesday. via @timstarks.bsky.social cyberscoop.com/trump-cyber-...

Completed draft of cyber strategy emphasizes imposing costs, industry partnership

The forthcoming Trump administration cyber strategy will introduce six key pillars, emphasizing deterrence of cyber threats and enhanced industry partnerships, with action items and deliverables for U...

cyberscoop.com

1/ United States, Australia, and United Kingdom sanction Russian threat activity enabler Media Land (Yalishanda) and follow up on recent designations targeting Aeza. ofac.treasury.gov/recent-actio...

www.politie.nl/nieuws/2025/...

Duizenden servers in beslaggenomen in omvangrijk cybercrime onderzoek

In een onderzoek naar een malafide hostingbedrijf zijn door het team cybercrime Oost-Nederland duizenden servers in beslaggenomen. Het hostingbedrijf wordt volgens de politie enkel en alleen gebruikt ...

politie.nl

1/ Reports indicating that CrazyRDP is the bulletproof hoster behind this seizure in the Netherlands. nltimes.nl/2025/11/14/d...

Dutch police seize thousands of servers used for ransomware, child sex abuse footage

The Dutch police seized thousands of servers in The Hague and Zoetermeer, used solely for hosting criminal activities. According to the police, the hosting company rented space to criminals to carry o...

nltimes.nl

1/ [UPDATE] As of November 10, 2025, metaspinner net GmbH has provided substantial evidence confirming Insikt Group’s original assessment that their identity was unlawfully and fraudulently used in the registration of #AS209800.

Lawrence S.@lawrencesec.bsky.social · 9mo ago

1/ New report from myself and @whoisnt.bsky.social: “Malicious Infrastructure Finds Stability with aurologic GmbH.” We uncover how German ISP aurologic GmbH has become a central nexus for high-risk hosting networks, sustaining large concentrations of malicious infrastructure.