threat.wiki

Threat intelligence notes, group profiles, named-person records, and defensive guidance.

Recent entries

• Webworm
• Fox Tempest
• TamperedChef-style productivity malware clusters
• Nx Console VS Code extension compromise
• Mini Shai-Hulud npm/PyPI worm campaign
• Handala
• APT29
• Microsoft Midnight Blizzard mailbox theft from Microsoft
• Dragonfly
• ConnectWise ScreenConnect exploitation wave
• Codecov Bash Uploader compromise
• Okta support-system compromise
• CitrixBleed session-hijack wave
• CircleCI 2023 customer secret exposure incident

Sections

• Ops — campaign timelines, compromise chains, and sequencing
• Tools — malware, payloads, implants, and attacker infrastructure
• Groups — crews, cluster names, and shared operational personas
• People — publicly identified individuals or project personas when public sourcing supports it
• Patterns — reusable defender heuristics
• Notes — taxonomy, usage, and editorial guidance