Cyber Intelligence Hub

Reduce your cyber risk and enhance your security posture with our expert resources. We provide the intelligence and strategies you need to protect your organization from evolving cyber threats.
AllCTICybercrimeDark Web
TeamPCP: When the scanner is the attacker
Threat Actor Spotlight

September 12, 2026

TeamPCP (UNC6780): From Telegram Data Broker to Supply Chain CascadeTeamPCP, (UNC6780), evolved from a Telegram-based stolen data broker into the actor behind a supply chain cascade that has compromised Trivy, Checkmarx KICS, LiteLLM, and hundreds of downstream packag
Iran APT
Threat Actor Spotlight

July 22, 2026

Iran's APTs and the U.S. Enterprise in 2026: A Strategic Shift You Can No Longer OutrunPost 1 of 5. Series introduction. How four state-aligned threat groups (MuddyWater, APT42, Prince of Persia, and APT34) moved from regional espionage to hybrid operations, and why their 2025-26 campai
ByteToBreach: A Deep Dive into a Persistent Data Leak Operator
Threat Actor Spotlight

July 17, 2026

ByteToBreach: A Deep Dive into a Persistent Data Leak OperatorKELA uncovers ByteToBreach, a technically skilled cybercriminal selling sensitive global data from airlines, banks, and governments. This profile reveals his tactics, targets, and online identities ac
Infrastructure Destruction Squad & BLACKNET-00: The Rise of a Hybrid Hacktivist-Ransomware Threat
Threat Actor Spotlight

July 6, 2026

Infrastructure Destruction Squad & BLACKNET-00: The Rise of a Hybrid Hacktivist-Ransomware ThreatThe Infrastructure Destruction Squad, is a hybrid threat actor blending hacktivism with cybercrime. They recently launched the $300 BLACKNET-00 ransomware builder alongside critical infrastructure exp
Inside The Gentlemen Leak: How a New RaaS Captured 10% of 2026’s Global Ransomware Victims
Threat Actor Spotlight

May 14, 2026

Inside The Gentlemen Leak: How a New RaaS Captured 10% of 2026’s Global Ransomware VictimsKELA’s deep dive into the 2026 Gentlemen Ransomware leak. See how they used Black Basta’s playbook and AI vibe-coding to become the world's #2 RaaS operation.
a magnifying glass with the words kela on it
Threat Actor Spotlight

March 26, 2026

Law enforcement seizes Leakbase The Event: Operation Leak dismantling a major hub
The High Price of Poor OPSEC: Inside the r1z Initial Access Broker Case
Threat Actor Spotlight

January 21, 2026

The High Price of Poor OPSEC: Inside the r1z Initial Access Broker Case The r1z case shows how initial access brokers monetize firewall exploits and enterprise access at scale, while the actor’s OPSEC failures leave long-term attribution trails that expose the ransomware
a picture of a dragon head on a white background
Threat Actor Spotlight

December 7, 2025

Ransomware Threat Actor Profile: QilinThis comprehensive analysis examines the Qilin ransomware-as-a-service group, which has emerged as a major cyberthreat since 2022. The post documents their aggressive campaign from August-September 20
Threat Actor 303 Exposed: Many Faces, One Hacker
Threat Actor Spotlight

November 3, 2025

Threat Actor 303 Exposed: Many Faces, One HackerKELA uncovers the many identities of a prolific cybercriminal known as “303,” linking hundreds of forum posts, Telegram accounts, and breaches across continents. The investigation exposes his tactics,