Pulsedive Threat Intelligence

In light of the recent ShinyHunters arrest, we analyzed the massive threat network they operate within: "The Com". We cover who they are, how groups like Scattered Spider and LAPSUS$ operate, and key mitigations for cybersecurity teams. Read now: blog.pulsedive.com/inside-the-c...

We recently created a guide for operationalizing ASN data for threat detection with @feedly.com Check out how, when, and why to track ASNs alongside IOCs here: feedly.com/ti-essential...

Our analysis of SolyxImmortal shows how the Python-based infostealer achieves: browser credential theft, cookie theft, keylogging, targeted screenshots, and Discord-based exfiltration, all in ~10KB. blog.pulsedive.com/solyximmorta...

Our threat research team details KiwiStealer's capabilities and a malware analysis of how it exfiltrates data via HTTP POST requests in our latest blog: blog.pulsedive.com/unpacking-ki...

Where do IPs and domains have a place in CTI workflows? What can and should you do with them? Here's our take: blog.pulsedive.com/collection-t...

Community Resource Share: "Ransomch(.)at" ransomch.at A collection of real-world ransomware negotiations in support of analysis, data-driven insights, and industry collaboration. The existing collection of chats from 23 ransomware brands so far include: Akira BlackBasta Conti Hive Lockbit REvil

Newest threat research blog out now: Albabat 2.0.0 Decoded We dig into Albabat's config file, executed ransomware commands, and ransom note. Read: blog.pulsedive.com/albabat-2-0-...

Just added 1.4K+ IOCs related to phishing kit Oriental Gudgeon, primarily targeting Japanese financial services cos. Investigate shared properties & attributes: pulsedive.com/threat/Orien... Explore IOCs: pulsedive.com/explore/?q=t... Credit to the urlscan team: urlscan.io/blog/2025/05...

Related Threats: Hellcat & Morpheus pulsedive.com/threat/Hellc... pulsedive.com/threat/Morph... - Recent growth in activity for both RaaS brands - Identical payloads suggest shared codebase - Differing victims and contact details

Community Share: "Black Basta Chat Leak - Organization & Infrastructure" by Cyber_0leg / Cybercrime Diaries www.cybercrimediaries.com/post/black-b... This blog examines exposed details of Black Basta, including its leadership hierarchies, business model, and technical infrastructure.

New research on the PolarEdge botnet: - Targeting edge devices (Cisco, QNAP, Synology, ASUS) - Active since at least Q4 2023 - Compromised 2K+ unique IP addresses - Report and analysis by Sekoia.io: lnkd.in/g4Wfi2Vt - Pulsedive profile: pulsedive.com/threat/Polar...

Browser extensions are commonly used, but present a significant security risk as a growing threat vector. Our newest blog looks at examples from January 2025, including Cyberhaven and GraphQL Network Inspector, to discuss how threat actors compromise extensions. blog.pulsedive.com/compromised-...

just pushed an update to @pulsedive.com, should improve scan performance and Analyze bulk scan hangs.

With 3 weeks left in 2024, we wanted to thank you for all you do in the security community. So we're hosting a year-end sticker giveaway through Dec. 21- no purchase necessary. To participate: - Like this post 👍 - Fill out: forms.gle/nxLQQxNtRahS...

Places to find infosec Black Friday deals: "The Big List for Infosec" github.com/0x90n/InfoSe... "For Security Professionals and Developers" github.com/davidalex89/... "Tagged, Searchable, and All Year Round" training.dfirdiva.com/current-disc...