# threat actor (blogs) — RSS Amplifier Recent posts from the 7 feeds in the RSS Amplifier directory that cover threat actor. Page: Feed: --- ## [Mandatory User Profile](https://ipurple.team/2026/08/11/mandatory-user-profile/) _2026-08-11 · Administrator · Purple Team_ The file NTUSER.MAN is a Windows user-profile registry hive used with mandatory profiles. It contains pre-defined configuration settings that are loaded into the registry (HKEY\_CURRENT\_USER) when the user authenticates. Organizations typically use the mandatory profiles in Kiosks and shared workstations. However, threat actors could abuse Mandatory User Profiles to establish persistence on Windows… ## [Attackers Target Agents via The Skill Supply Chain](https://www.mbgsec.com/posts/2026-08-06-attackers-target-agents-via-the-skill-supply-chain/) _2026-08-06 · Michael Bargury · Michael Bargury_ An active malware campaign used typosquatted skills, trojanized packages, and remote loaders to target users of popular AI tools. ## [Provisioning Packages](https://ipurple.team/2026/08/04/provisioning-packages/) _2026-08-04 · Administrator · Purple Team_ Windows Provisioning Packages are used by Administrators to deploy configuration scripts on Windows environments by using a container format. Threat actors with elevated privileges could abuse provisioning packages to hide arbitrary payloads and commands within these containers. Furthermore, it could be used in conjunction with social engineering to deliver packages attached to emails targeting… ## [AMSI Provider](https://ipurple.team/2026/07/13/amsi-provider/) _2026-07-13 · Administrator · Purple Team_ The Antimalware Scan Interface (AMSI) is a Microsoft control that directs PowerShell content to the installed antimalware engine or EDR to conduct a scan and identify malicious indicators. However, for functionality purposes Microsoft permits third-party applications to register AMSI providers with the operating system in order to communicate with the interface. Threat actors with elevated \[ \] ## [Windows Service](https://ipurple.team/2026/07/06/windows-service/) _2026-07-06 · Administrator · Purple Team_ Windows Services are a common target for adversaries because they provide a reliable mechanism for executing code with elevated privileges, maintaining persistence, and blending malicious activity into normal Windows operations. Abusing Windows services for persistence is not a new technique, and most Endpoint Detection and Response can detect malicious modification of services or service… ## [Attackers Don’t Buy Tokens. They Steal Yours.](https://www.mbgsec.com/posts/2026-07-06-attackers-dont-buy-tokens-they-steal-yours/) _2026-07-06 · Michael Bargury · Michael Bargury_ For six months we ran a global network of AI honeypots with exposed inference and agent endpoints. Attackers found them fast, exploiting days-old CVEs for RCE, stealing environment variables and API keys, and hijacking our infra to run offensive tooling against real victims. The twist: to abuse our tokens they had to hand over their prompts, tools, and reasoning, leaving the attacker's intent… ## [QoS Policies](https://ipurple.team/2026/06/17/qos-policies/) _2026-06-17 · Administrator · Purple Team_ In Windows, a Quality of Service (QoS) policy is a rule that handles outbound network traffic. Specifically, it is used to cap the outbound bandwidth of a process, port, or protocol. Organizations can configure QoS policies through Group Policies, MDM, or PowerShell. Threat actors with elevated privileges on the asset can point a QoS policy \[ \] ## [WinGet](https://ipurple.team/2026/06/09/winget/) _2026-06-09 · Administrator · Purple Team_ WinGet also known as Windows Package Manager, is Microsoft s command-line for discovering, installing, upgrading, configuring, and removing applications on Windows. It is commonly used by Administrators and developers to automate software deployment and system setup. However, it can be abused to proxy execution and evade detection. Threat actors can execute arbitrary PowerShell scripts in the \[ \] ## [Give Us Your Taste](https://www.mbgsec.com/posts/2026-05-28-give-us-your-taste/) _2026-05-28 · Michael Bargury · Michael Bargury_ AI slop is creeping into Slack messages, emails, tickets, and docs, and it's hollowing out the human intent that makes communication valuable. Use AI to sharpen your thinking, but don't reduce yourself to a copy-paste operator. We want your taste, your deliberate choices. ## [Predatory Sparrow, Out In The Cold?](https://pylos.co/2026/05/25/predatory-sparrow-out-in-the-cold/) _2026-05-25 · Joe · Stranded on Pylos_ “Predatory Sparrow” first emerged as a self-proclaimed hacktivist group in 2021 with pro-Israel intentions and operations focused on disruptive activity targeting Iranian entities and interests, although there a potential signs of even earlier operations against Syria. Of note, whereas most hacktivist entities or personas exhibit far more “bluster” than actual \[…\] ## [Dissecting Series A Rounds (Sponsored)](https://crawlproof.com/a/1nJknFyooWER) _2026-05-25 · **Sponsored**_ Two real Series A cases: timelines, investor sequencing, and common founder mistakes. ## [EntryPoint Hijacking](https://ipurple.team/2026/05/13/entrypoint-hijacking/) _2026-05-13 · Administrator · Purple Team_ The technique of EntryPoint Hijacking introduces a stealthier approach to code injection, as it doesn’t rely on API calls that create a new thread within the process context, and it is independent of the attack chain. Arbitrary code is written to memory, but it executes only when the process legitimately creates a new thread. This \[ \] ## [Cross-Session Activation](https://ipurple.team/2026/05/04/cross-session-activation/) _2026-05-04 · Administrator · Purple Team_ Traditional lateral movement techniques are no longer applicable in the modern era due to developments in the detection capability by most of the EDR vendors. Techniques that abuse legitimate Windows functionality, such as COM, has always been in the interest of adversaries. Cross-Session activation (CSA) is considered the latest evolution of lateral movement via the \[ \] ## [A Brief Critique of Practical Threat Intelligence](https://pylos.co/2026/05/03/a-brief-critique-of-practical-threat-intelligence/) _2026-05-03 · Joe · Stranded on Pylos_ “Intelligence” is an overloaded concept in that the term may refer to a variety of items, actions, and deliverables. Attempts to define intelligence have existed for decades, and for a seemingly direct concept lead to extended discussion. As such, relatively new variations of this concept, such as “cyber threat intelligence” \[…\] ## [Myth & Mythos: Where Do We Go From Here?](https://pylos.co/2026/04/11/myth-mythos-where-do-we-go-from-here/) _2026-04-11 · Joe · Stranded on Pylos_ Computer science and particularly information security stories can occasionally “color” more general discourse, such as rampant speculation of cyber components of recent conflicts. But rarely do highly technical items reach true “escape velocity” to inundate popular media. The past few days have observed just this phenomenon with Anthropic’s announcement of \[…\] ## [Microsoft Speech](https://ipurple.team/2026/04/07/microsoft-speech/) _2026-04-07 · Administrator · Purple Team_ SpeechRuntime is a legitimate Windows component that supports Microsoft s speech-related capabilities, including voice input and speech recognition features used across modern Windows experiences. The SpeechRuntime.exe binary is linked to the Microsoft speech framework. However, threat actors with elevated privileges can move laterally by executing code under the context of the user that has an… ## [Toast Notifications](https://ipurple.team/2026/03/25/toast-notifications/) _2026-03-25 · Administrator · Purple Team_ The Application User Model ID (AUMID) is a unique identifier that Windows assigns to modern applications. It enables Windows to identify which applications should receive notifications, how start menu entries are associated, how toast notifications map back to an application etc. Many organizations use Toast Notifications to push internal updates to endpoints such as IT \[ \] ## [Pro-Iranian threat actor Handala – new websites](https://osintme.com/index.php/2026/03/22/pro-iranian-threat-actor-handala-new-websites/) _2026-03-22 · Matt · osintme.com_ Overview of psy-op domains associated with Handala, a pro-Iranian threat actor group. ## [Agent Compromised by Agent To Deploy an Agent](https://www.mbgsec.com/posts/2026-02-19-agent-repo-compromised-by-agent-to-install-an-agent/) _2026-02-19 · Michael Bargury · Michael Bargury_ An investigation into the Cline supply chain attack, revealing how a bug bounty hunter weaponized a public PoC via prompt injection to steal npm credentials. ## [Raptor Finds Root Cause of Cline’s Supply-Chain Compromise](https://www.mbgsec.com/posts/2026-02-18-raptor-finds-cline-compromise/) _2026-02-18 · Michael Bargury · Michael Bargury_ Investigating the recent Cline CLI supply-chain compromise using the Raptor AI agent to conduct OSS forensics and uncover the root cause. ## [OSINT & online crime books for investigators – the Osint Me 2026 reading list](https://osintme.com/index.php/2026/01/31/osint-online-crime-books-for-investigators-the-osint-me-2026-reading-list/) _2026-01-31 · Matt · osintme.com_ A personal list of reading recommendations for 2026 for investigators and OSINT enthusiasts. ## [Refer a Friend, Earn Rewards (Sponsored)](https://crawlproof.com/a/uH9t1ehtbsGY) _2026-01-31 · **Sponsored**_ Earn rewards when a friend signs up for the Graphite Business Card ## [Attributive Questions in High Profile Incidents](https://pylos.co/2026/01/31/attributive-questions-in-high-profile-incidents/) _2026-01-31 · Joe · Stranded on Pylos_ On 30 January 2026, CERT.PL published findings concerning an electric sector attack on Poland in December 2025. This report, presumably the most complete on the incident covering multiple sources and coming from those directly responding to the total incident, arrived after earlier reporting from commercial organizations on elements of the \[…\] ## [Calculating Website Age & Tracking Changes With URL Dater](https://nixintel.info/osint-tools/calculating-website-age-tracking-changes-with-url-dater/) _2026-01-11 · Nixintel · Nixintel Open Source Intelligence & Investigations_ How can you determine the age of a webpage in a reliable way? URL Dater uses a range of different sources to present an accurate picture. ## [First Public Confirmation of Threat Actors Targeting AI Systems](https://www.mbgsec.com/posts/2026-01-11-first-public-confirmation-of-ta-targeting-ai-systems/) _2026-01-11 · Michael Bargury · Michael Bargury_ Security researchers have publicly confirmed, for the first time, that threat actors are actively scanning and probing enterprise AI systems for exploitation. Correlated observations from DefusedCyber and GrayNoise show systematic reconnaissance of exposed LLM endpoints—using techniques associated with known CVE exploitation pipelines—marking a shift from theoretical AI risk to active adversary… ## [Linux desktop apps for your OSINT machine](https://osintme.com/index.php/2025/10/31/linux-desktop-apps-for-your-osint-machine/) _2025-10-31 · Matt · osintme.com_ Recommended Linux Mint native desktop apps for OSINT general productivity. ## [Make Real Progress In Security From AI](https://www.mbgsec.com/posts/2025-10-08-making-real-progress-in-security-from-ai/) _2025-10-08 · Michael Bargury · Michael Bargury_ Links and deck for my keynote at AI Agent Security Summit, SF Oct 8. There's a big discrepancy between our feeling of progress and reality for hackers. AI security and safety benchmarks go up. But hackers don't notice. Their partying like its 1999. Security from AI has been going in the wrong direction, relying on soft boundaries like AI guardrails and safety training. We CAN make progress though.… ## [Intelligence Poverty and the Commercial Data Economy](https://pylos.co/2025/09/01/intelligence-poverty-and-the-commercial-data-economy/) _2025-09-01 · Joe · Stranded on Pylos_ A core part of my teaching at Paralus is guiding attendees towards mechanisms of fusing internal telemetry and understanding with external data sources and feeds to arrive at a more robust understanding of threat actor operations and behaviors. This perspective is reflected in my work on intelligence production and development \[…\] ## [The Beginning and Ending of Threat Actors](https://pylos.co/2025/08/29/the-beginning-and-ending-of-threat-actors/) _2025-08-29 · Joe · Stranded on Pylos_ In July 2025, NSA officials at a conference in New York City made a surprising claim: “The good news is, \[Volt Typhoon\] really failed. They wanted to persist in domestic networks very quietly for a very long time so that if and when they needed to disrupt those networks, they \[…\] ## [How Should AI Ask for Our Input?](https://www.mbgsec.com/posts/2025-08-28-human-machine-interface-role-reversal/) _2025-08-28 · Michael Bargury · Michael Bargury_ How should we reason about machines taking over ## [Pwn the Enterprise - thank you AI! Slides, Demos and Techniques](https://www.mbgsec.com/posts/2025-08-08-enterprise-ai-compromise-0click-exploit-methods-sneak-peek/) _2025-08-08 · Michael Bargury · Michael Bargury_ Bottom lines, demos, slides, and attacker capabilities from the BlackHat USA 2025 talk ## [Someone Is Cleaning Up Evidence](https://www.mbgsec.com/posts/2025-07-26-tracking-down-the-amazon-q-attacker-through-deleted-prs/) _2025-07-26 · Michael Bargury · Michael Bargury_ The attacker deletes their user. Luckily we still have GH Archive. ## [CLI-first decentralized GPU compute (Sponsored)](https://crawlproof.com/a/WGuktUQqmJlz) _2025-07-25 · **Sponsored**_ Pay workers or run your GPU for FFmpeg transcode and AI inference. ## [Will the Real Salt Typhoon Please Stand Up?](https://pylos.co/2025/07/23/will-the-real-salt-typhoon-please-stand-up/) _2025-07-23 · Joe · Stranded on Pylos_ On 17 July 2025, Bloomberg (no stranger to interesting information security reporting) issued a gated report on a non–public Recorded Future item related to Salt Typhoon activity. As previously noted in this space, Salt Typhoon operations are both incredibly significant given their targeting and scope, while also poorly understood and \[…\] ## [OSINT tools and techniques for research on Reddit](https://osintme.com/index.php/2025/07/18/osint-tools-and-techniques-for-research-on-reddit/) _2025-07-18 · Matt · osintme.com_ A list of hands on tested Google dorks and third party tools for doing OSINT research on Reddit.com. ## [The Intellectual Dishonesty and Moral Poverty of “Shields Up”](https://pylos.co/2025/07/13/the-intellectual-dishonesty-and-moral-poverty-of-shields-up/) _2025-07-13 · Joe · Stranded on Pylos_ The United States’ Cybersecurity and Infrastructure Security Agency (CISA) launched a campaign roughly aligned with Russia’s horrific invasion of Ukraine in 2022 called “Shields Up.” At its core, “Shields Up” was designed as a set of relatively straightforward security best practices to prepare for expected increases in threat actor operations. \[…\] ## [Attribution With A Pinch of Salt (Typhoon)](https://pylos.co/2025/06/11/attribution-with-a-pinch-of-salt-typhoon/) _2025-06-11 · Joe · Stranded on Pylos_ Salt Typhoon first emerged in the public consciousness with media reporting in late 2024. The previously unknown (or overlooked) threat actor was quickly linked to widespread intrusions in major US-based telecommunications companies, and targeting of both specific systems used to enable lawful intercept operations as well as the communications of \[…\] ## [Darkweb OSINT resources for investigators – 2025](https://osintme.com/index.php/2025/03/31/darkweb-osint-resources-for-investigators-2025/) _2025-03-31 · Matt · osintme.com_ Some Tor website links and resources for darkweb investigators - 2025 edition. ## [Malicious Ukrainian themed DELTA Android Application Analysis](https://threatintelligence.substack.com/p/malicious-ukrainian-themed-delta) _2025-03-30 · Jack · Jack’s Substack_ Reverse engineering a Ukrainian themed malicious Android application ## [Using SSL Certificates To Find Threat Actor Infrastructure](https://nixintel.info/osint/using-ssl-certificates-to-find-threat-actor-infrastructure/) _2025-03-22 · Nixintel · Nixintel Open Source Intelligence & Investigations_ At last month’s SANS OSINT Summit I gave a talk the usefulness of SSL certificates for open source intelligence researchers. The talk looks at three recent examples of how information from certificate transparency logs can be used to discover, attribute, and unmask threat actor infrastructure. The video of the talk has now been published and you can \[ \] ## [Malicious DELTA themed Android App found in 2025](https://threatintelligence.substack.com/p/malicious-delta-themed-android-app) _2025-03-11 · Jack · Jack’s Substack_ More malicious activity utilising DELTA themes from a suspected Russia-based threat actor ## [PhaaS: The threat that keeps hitting inboxes](https://threatintelligence.substack.com/p/phaas-the-threat-that-keeps-hitting) _2025-01-22 · Jack · Jack’s Substack_ A case study for needing threat intelligence indicator democratisation ## [The importance of favicons in website OSINT research](https://osintme.com/index.php/2025/01/20/the-importance-of-favicons-in-website-osint-research/) _2025-01-20 · Matt · osintme.com_ Find out how useful the favicon research is in website OSINT. ## [Telegram For Cyber Investigators](https://nixintel.info/osint/telegram-for-cyber-investigators/) _2024-11-17 · Nixintel · Nixintel Open Source Intelligence & Investigations_ Telegram is one of the most important platforms for OSINT investigators. I joined the Needlestack podcast to discuss how Telegram works and shared some practical OSINT advice along the way. ## [Detecting a business email compromise (BEC) threat actor](https://threatintelligence.substack.com/p/detecting-a-business-email-compromise) _2024-09-24 · Jack · Jack’s Substack_ Identifying an uncommon BEC threat actor ## [OSINT resources for researching ransomware](https://osintme.com/index.php/2024/09/20/osint-resources-for-researching-ransomware/) _2024-09-20 · Matt · osintme.com_ Multiple sources and datasets for investigating ransomware activity.