Threat Inteliigence / OSINT / NETSEC / NATSEC

MSS - Ministry of State Security and its cyber activities

In the previous post, we dealt with the intelligence activity of the People's Liberation Army and how the reforms of the armed forces are aimed at improving their functioning in this field. This time we will focus on an agency dealing with typically intelligence tasks - the Ministry of State Security (国家 安全 部, MSS). To begin with a brief historical outline, the modern organization of the MSS is [...]

Jack Bauer on Facebook - terrorism and social media

When I started working in cybersecurity as a SOC analyst, I often looked at job offers in the industry in my spare time. Contrary to malicious comments, it was not caused by the will to change the employer as soon as possible, but rather by learning career paths and planning the direction of development. I remember that one of the ads that caught my attention a lot [...]

When the DoJ publishes your photo - about indictments and cyber operations

Observing the practice of the US administration in the field of political tools applied to entities responsible for cyber operations against the States, indictments are one of the most visible elements. In recent years, we have seen, for example, indictments against a GRU officer, Chinese intelligence, or more recently FSB officials. On the surface, it may seem that such actions do not [...]

Hunting for implants - OSINT malware analysis

I started to write a post about malware analysis in the context of OSINT and threat intelligence for a long time. It is one of the most widely used sources of information and a common goal of analyst research, but at the same time a technically complex issue. If we are talking about advanced static analysis (of the file itself) and dynamic (observing the behavior of the file after running), it is [...]

A look at cyber operations during the first days of the conflict in Ukraine

In the previous post, I tried to present what types of cyber operations accompany military actions and how different types of operations are supposed to achieve their goals by different means. Some may have expected much more intense cyber activities in Ukraine, attacks on industrial networks or the massive use of wipers. Although there are no signals indicating [...]

By observing Internet houses - we analyze domains and their infrastructure

One of the most common tasks related to OSINT and threat intelligence is the analysis of Internet domains in terms of infrastructure behind them and information about entities responsible for their creation. Domains are an important element of cyber operations, when they can be used for C2 communication, malware delivery and information operations, providing [...]

OSINT Wolves of Wall Street - gathering information on companies in open sources

Nowadays, OSINT is most often associated with the analysis of threats, journalistic investigations and verification of information, for example, from places subject to military operations. However, if we zoom out a bit and look at the phenomenon of collecting publicly available information and analyzing it in order to achieve specific results, it forms the basis of one of the most important contemporary institutions [...]

en_USEnglish