5-stages-of-the-threat-intelligence-lifecycle
Blue Origin Leak Claim, iOS Zero Day Sale, VPN and AWS Access Listings, and Ticketmaster Database Post SOCRadar Dark Web Team identified several new underground posts, including a claim of leaked Blue Origin documents tied to a ransom demand, a separate listing advertising an alleged full-chain iOS exploit, and access sales marketed with elevated privileges. […]
WormGPT: The Blueprint for Malicious AI The story of WormGPT is about what happens when a proof-of-concept becomes a brand and is one of the first examples of how AI is used in cyberattacks. Origins and the Original Version On June 28, 2023, a user on a popular hacking forum introduced WormGPT, marketing it as […]
OSINT Tools for Cybersecurity: A Practical Guide for Security Teams Attackers are already running open source intelligence operations against your organization. They are mapping your exposed infrastructure, harvesting employee credentials from breach databases, and identifying unpatched systems, all before writing a single line of exploit code. The question is whether your security team is doing […]
Bitwarden CLI Hijacked in npm Supply Chain Attack Linked to TeamPCP & Checkmarx Breach A malicious version of the Bitwarden CLI circulated on npm for roughly 90 minutes on April 22, 2026, silently stealing developer credentials, cloud secrets, and CI/CD tokens before exfiltrating them through encrypted channels. The attack is part of a broader wave […]
Apple has released security updates to address a Notification Services issue in iOS and iPadOS that could cause alerts marked for deletion to remain stored on a device. The fix was delivered in iOS 26.4.2 / iPadOS 26.4.2 and iOS 18.7.8 / iPadOS 18.7.8, where Apple says the problem was resolved through improved data redaction. […]
Microsoft has released out-of-band updates for CVE-2026-40372, a high-impact ASP.NET Core privilege-escalation vulnerability tied to the platform’s Data Protection cryptographic APIs. Public reporting says the flaw carries a CVSS score of 9.1 and could allow an unauthenticated attacker to forge authentication material and ultimately obtain SYSTEM privileges on affected systems. The issue stands out not […]
How OSINT is Used in Cybersecurity (Real-World Use Cases) In 2018, investigators at Bellingcat unmasked 305 officers from Russia’s military intelligence unit, GRU Unit 26165, using nothing but a public vehicle registration database and a Moscow address. No classified leaks. No hacking. Just open-source data, read carefully. That story captures what OSINT is and why […]
How AI Changed Vishing: Case of PlugValley Vishing or voice phishing is not a new attack. Fraudsters have been calling people and pretending to be banks, government agencies, and tech support for decades. What has changed is not the concept. Running a vishing operation used to demand a lot from an attacker. A convincing voice. […]
The Problem: Achieving Threat Detections at Scale At SOC Prime, we have spent over a decade making detection engineering easier for organizations of every size. Each year, as threats multiply and environments grow more complex, the traditional approach puts SOC Managers in an impossible position — responsible for coverage they cannot achieve with the tools […]