Liberty91LTD/cti-skills

# AbuseIPDB API v2

## Base URL
`https://api.abuseipdb.com/api/v2`

## Authentication
Header: `Key: $ABUSEIPDB_API_KEY`
Also: `Accept: application/json`

## Rate Limits
- Free: 1000 checks/day, 500 reports/day
- Premium: Higher limits

## Key Endpoints

# Analysis of Competing Hypotheses (ACH)

ACH is the most important structured analytic technique for CTI. It forces you to evaluate ALL plausible hypotheses against ALL significant evidence, reducing the impact of cognitive biases — especially confirmation bias.

## When to Use ACH

- Attribution questions: "Who is behind this campaign?"
- Ambiguous situations: Multiple plausible explanations exist
- High-stakes assessments: Getting it wrong has significant consequences
- Contested analysis: Analysts disagree on the conclusion

## Evidence: Graded Preferred, Ungraded Allowed

ACH works best on graded evidence items, one per claim, as produced by `/quality-of-information-check` (the QoI JSON or its claim table). The schema is in `skills/quality-of-information-check/references/evidence-item-schema.md`. Grading is the default. It is not a condition for running.

# Campaign Tracking

A campaign is a coordinated set of malicious activities carried out by a threat actor against specific targets over a defined period.

## Sourcing Before Tracking

A campaign record is built from claims, and each claim belongs to the source that originated it. Before any report feeds the record:

1. **Resolve provenance.** Run `/source-provenance` on every ingested report or article. Record the primary, the chain and the `provenance_basis` (platform-resolved, script-resolved or model-judged).
2. **Dedupe by primary, not by URL.** Five outlets covering one vendor report are one source and produce one timeline row, not five. List the outlets as "via". Count corroboration by independent primaries with separate access only.
3. **Grade per claim.** Run `/quality-of-information-check` on the primary (it calls `/claim-extraction`). The intrusion, the vector, the attribution and the actor's own figures carry different grades.
4. **Store the grade with the entity.** Every timeline row, attack chain row, attribution statement and victim count carries the primary that supports it and the grade of the supporting claim.

Actor claims about victim count or data volume are graded "adversary, unverified" until an independent primary corroborates them. Record them as actor-claimed, not as findings. Grades follow the fixed rubric in `/quality-of-information-check` (`references/grading-rubric.md`). The grade is two words, access level then claim support, for example "direct, firm". It is not an Admiralty rating. Your own telemetry and SOC alerts are primaries in their own right, name them as such.

# Carding & Financial Fraud

## Executive Summary

Carding and financial fraud represent one of the oldest and most mature cybercriminal ecosystems, encompassing the theft, trade, and monetization of payment card data and financial credentials. The ecosystem spans from initial data theft (via digital skimming, phishing, POS malware, and database breaches) through underground marketplace trading to monetization via card-not-present (CNP) fraud, mobile wallet fraud, money mule networks, and reshipping schemes. CNP data still dominates the underground card market, but card-present fraud has returned in a new form: stolen cards provisioned into Apple and Google wallets and used or relayed over NFC [11][13].

The card shop landscape changed materially in 2025. BidenCash, previously the most visible shop, was seized on June 4, 2025 by the US Secret Service and FBI with Dutch police support (about 145 domains; no arrests announced) [9]. In September 2025 the Manhattan District Attorney seized 12 domains belonging to five further vendors, including B1ack's Stash, but Recorded Future assesses that most of those shops kept posting card data on related domains [10][11]. B1ack's Stash took over BidenCash's free-dump marketing tactic and released a further 4.6 million records in May 2026 [12]. Recorded Future counted about 142 million card records posted for sale on dark web marketplaces in 2025, down 19% from 2024, while freely exposed records on Telegram and other sources rose 26% to a comparable volume, and 82% of for-sale CNP records came with victim contact details [11].

The most significant shift in technique is the Chinese-language fraud ecosystem. Smishing kits such as Lighthouse, Darcula and Lucid harvest card data and one-time codes, enroll the cards in mobile wallets on attacker-controlled phones, and cash out in stores or through NFC relay ("ghost tap") tools sold as a service on Telegram [13][14][17]. Google sued the Lighthouse operators in November 2025 and the service reported its servers blocked within days, though researchers expected the activity to continue under other names [15][16]. NFC relay malware has since spread beyond Chinese-speaking vendors to independently developed families in Europe and Latin America [18][20].

Web skimming (Magecart) remains stable at scale rather than declining: Recorded Future tracked more than 10,500 active e-skimmer infections in 2025 despite the PCI DSS 4.0 script-integrity requirements taking effect, with skimmer kits and skimming-as-a-service lowering the barrier to entry [11]. The fraud ecosystem continues to overlap with infostealers, Business Email Compromise (BEC), SIM swapping and Fraud-as-a-Service (FaaS) offerings, and in 2026 researchers documented AI agents being used to automate retailer compromise and skimmer deployment [28].

## Key Actors

# Censys API v2

## Base URL
`https://search.censys.io/api/v2`

## Authentication
Basic Auth: `$CENSYS_API_ID:$CENSYS_API_SECRET`

```bash
curl -s "https://search.censys.io/api/v2/hosts/{ip}" \
  -u "$CENSYS_API_ID:$CENSYS_API_SECRET"
```

## Rate Limits

# China Cyber Espionage Knowledge Cell

## Executive Summary

China operates the most extensive state-sponsored cyber espionage apparatus globally. Operations are tasked primarily by the Ministry of State Security (MSS) and the People's Liberation Army (PLA), with the Ministry of Public Security (MPS) also named as a customer in U.S. indictments. Since 2025 the public record has shifted from describing discrete "APT groups" to describing an ecosystem: government advisories, sanctions and indictments now name the private companies that build tooling, run infrastructure and sell stolen data to the state. Named firms include i-Soon, Integrity Technology Group, Shanghai Heiying, Sichuan Juxinhe, Beijing Huanyu Tianqiong and Sichuan Zhixin Ruijie [9][10][11][12][22]. One consequence is that vendor cluster names no longer map cleanly onto organisations, and sources disagree on several mappings (see Key Actors).

Two strategic lines of effort remain active. The first is espionage against communications infrastructure: the activity tracked as Salt Typhoon was described in August 2025 by agencies from 13 countries as a global campaign running since at least 2021 against telecommunications, government, transportation, lodging and military networks [9]. European governments continued to disclose compromises into 2026 [26][27]. The second is pre-positioning in critical infrastructure, associated with Volt Typhoon. U.S. advisories attribute Volt Typhoon to PRC state-sponsored actors without naming a service [1]. The Wall Street Journal reported in April 2025 that Chinese officials indirectly acknowledged the activity in a December 2024 meeting in Geneva, in remarks U.S. officials read as linked to U.S. support for Taiwan [30].

Tradecraft has converged on the network edge and on systems that cannot run endpoint detection. The 2025-2026 record is dominated by exploitation of VPN, firewall, router and email appliances, by backdoors placed on VMware vCenter and ESXi hosts with dwell times averaging over a year [17][18], by abuse of stolen credentials, API keys and OAuth applications to reach downstream customers of IT providers [13], and by covert networks of compromised SOHO and IoT devices that a 15-agency advisory in April 2026 said the majority of China-nexus actors now use [22]. CrowdStrike reported a 38% rise in China-nexus activity in 2025 [32]. In November 2025 Anthropic reported the first documented espionage campaign in which an AI model carried out most of the intrusion work, attributed with high confidence to a Chinese state-sponsored group [20].

Traditional espionage against governments continues alongside this. Mustang Panda clusters remained active across Asia and returned to European diplomatic targeting from mid-2025, extending to the Middle East in March 2026 [23][24]. APT41 continued government targeting using cloud services for command and control [19].

## Key Actors

# claim-extraction

An event is a bundle of claims with very different evidentiary standing. "Akira exploited a SonicWall zero-day to hit a US hospital and exfiltrated 400GB" is at least four claims:

| Claim | Type | Where it comes from |
|---|---|---|
| The hospital suffered an intrusion | `victim_disclosure` | The hospital's own notification |
| Initial access was through a SonicWall vulnerability | `observation` | A vendor's incident response finding |
| The intrusion was carried out by Akira | `attribution` | A leak-site posting plus TTP overlap |
| 400GB of data was taken | `actor_claim` | The actor's own statement |

One grade on the event either averages these into something meaningless or takes the strongest and inflates the weakest. This skill splits the document so each claim can be graded on its own.

**Composition.** Uses the fetcher in `/source-provenance`. Invoked by `/quality-of-information-check`. Output is consumed by `/ach`, `/key-assumptions-check`, `/intelligence-writing`, `/writing-assessments`, `/threat-actor-profiling` and `/campaign-tracking`.

# Confidence Levels

Every analytical judgment produced by this platform MUST carry a confidence level. Confidence reflects the quality and quantity of evidence supporting the judgment, NOT the probability that the event will occur (that's likelihood — see likelihood-language skill).

## Primary Scale: Named Bands

Three levels, following ICD 203. Each band is tied to the claim support of the evidence underneath, as graded by `/quality-of-information-check`. On export, STIX `confidence` comes from claim support: established 90, firm 70, tentative 50, disputed 30, and unverified omits the property. These values are the pack's own mapping, chosen to sit inside the bands below, so a confidence level, a STIX `confidence` value and the grade of the evidence underneath all say the same thing.

| Band | Score Range | Meaning | Evidence it requires |
|------|-----------|---------|---------|
| **High** | 80-100 | Based on high-quality information from multiple independent sources. Well corroborated. High confidence does not mean the judgment is a fact. | Every load-bearing claim at claim support established, with access level direct or limited |
| **Moderate** | 60-79 | Based on credibly sourced and plausible information that is not corroborated enough to warrant higher confidence. Alternative interpretations exist. | Weakest load-bearing claim at claim support firm, or established with access level indirect |
| **Low** | 40-59 | Based on limited or fragmentary information, or on a judgment the source itself hedged. Several plausible alternative interpretations. | Weakest load-bearing claim at claim support tentative |
| **No confidence level** | none | The evidence cannot carry a judgment. Do not attach a label. State what is known, state the gap, and say what collection would close it. | Any load-bearing claim at claim support disputed or unverified |

# Control Coverage Mapping

Answers one question with evidence instead of opinion: **which attacker techniques does this control set actually address, and at what strength?**

The usual way to answer it is to put people in a room and negotiate a percentage. This skill replaces that with a join against a public, versioned table that both sides can read and challenge. Where the evidence rates a control's strength, that rating is carried through unchanged. Where it does not, the output says so rather than inventing a number.

## When to invoke

- The user asks what their controls cover, where the gaps are, or how to prioritise security spend
- The user asks **what controls they should have** for a given threat, campaign or sector, with no baseline in hand
- A threat profile has produced a technique list and the next question is "so are we covered?"
- A FAIR or risk-quantification workflow needs the **Resistance Strength** input
- Board or audit reporting needs a defensible coverage statement with citations
- A vendor claims a product "stops" a technique and you want the public evidence

# CrowdStrike Falcon Intelligence (Intel) API

This is reference documentation. The agent-invokable lookup skill is `/lookup-crowdstrike`; the runtime CLI is `tools/clis/crowdstrike.py`. Read this file when the lookup skill's options are not enough and you need to know which raw endpoint to hit, what fields a response carries, or how to construct an FQL query the CLI does not expose directly.

Source of truth: https://developer.crowdstrike.com/api-reference/collections/intel/

## Base URL

OAuth2 base differs by cloud region. The Intel path prefix is `/intel/`.

| Cloud | Base URL |
|---|---|
| US-1 (default) | `https://api.crowdstrike.com` |
| US-2 | `https://api.us-2.crowdstrike.com` |

# CTI Hyperloop Framework

The CTI Hyperloop (based on Google/Mandiant's practical implementation framework) extends the traditional intelligence cycle by running it at three levels simultaneously with continuous bidirectional feedback.

## Core Concept

Traditional intelligence cycle: linear, single-track, often stuck at the tactical level.
Hyperloop: three parallel tracks (strategic, operational, tactical) feeding each other continuously.

```
STRATEGIC  ←→  OPERATIONAL  ←→  TACTICAL
    ↓              ↓               ↓
Direction → Collection → Processing → Analysis → Dissemination → Feedback
    ↑                                                              |

# cti-orchestrator

You are the default entry point for the `cti-skills` pack. When a user's request doesn't name a specific skill, activate here. Your job is to:

1. Classify the request
2. Invoke the right downstream skill(s)
3. Auto-apply rigor skills on the result
4. Return a source-rated, confidence-marked product

You do NOT query external APIs directly. Compose other skills — especially the `lookup-*` skills — to do the work.

## When to activate

Activate on any of these user intents:

# cti-setup

In-chat configuration of API keys for the threat-intel integrations bundled with this pack. Use this when the user is in Claude Code and doesn't want to drop to a shell to run `./scripts/setup.sh`.

## When to invoke

- User asks "how do I set up keys", "configure my API keys", "add a VirusTotal key", etc.
- User runs `/cti-setup`
- A `lookup-*` skill failed because a key is missing and you want to offer to add it
- After install via `/plugin marketplace add` or `npx` (no shell setup ran)

## What you do

1. **Check current state.** Read `.claude/settings.local.json`. If it's missing or has no `env` block, the user has zero keys configured. If it has some, list which are present and which are missing.

# Dark Web Collection

A practical, defender-oriented methodology for collecting cyber threat intelligence from underground forums, marketplaces, and Telegram channels. The skill assumes you are a defensive analyst, not a covert operator, and recommends a vendor-first posture with self-hosted DIY collection documented as a fallback.

This SKILL.md is the entry point. The substantive material lives in `references/` and `scripts/`:

- [`references/forums.md`](references/forums.md) — 35+ sourced underground forums across 8 categories
- [`references/telegram-channels.md`](references/telegram-channels.md) — 30+ sourced Telegram channels across 6 categories
- [`references/access-methods.md`](references/access-methods.md) — vendor matrix + DIY playbook
- [`references/opsec.md`](references/opsec.md) — handler-side OPSEC primer
- [`references/passive-monitoring.md`](references/passive-monitoring.md) — selector strategy and tooling
- [`references/telegram-setup.md`](references/telegram-setup.md) — step-by-step setup for `telegram_monitor.py` (api_id, burner, session file)
- [`scripts/onion_search.py`](scripts/onion_search.py) — clearnet search of onion indexers (Ahmia, dark.fail, IntelligenceX)
- [`scripts/telegram_monitor.py`](scripts/telegram_monitor.py) — read-only Telethon channel monitor (requires `--i-understand-opsec` for live ops)

# Devil's Advocacy

A contrarian technique from the CIA Tradecraft Primer. It takes the team's own lead judgment as its input and argues that the judgment is wrong. Its output is a rebuttal.

It is not Red Team Analysis. Red teaming is an imaginative technique: it reasons as the adversary would, from the adversary's position and constraints, and produces adversary courses of action. This pack does not have a Red Team Analysis skill. Until version 2.0 this skill carried that name.

When consensus is strong, this technique deliberately argues the opposing position. The goal is not to be contrarian for its own sake — it's to find genuine weaknesses in the prevailing analysis before they become blind spots.

## When to Use
- Consensus is strong and unchallenged
- High-stakes assessment (wrong conclusion = significant harm)
- Analysis has been produced quickly under pressure
- The same team that collected also analysed (potential tunnel vision)
- Before publishing a product that will drive significant decisions

# domain-investigation

Investigate a domain or hostname end-to-end. Chain `lookup-*` skills, consolidate, prioritize follow-up IOCs, and return a rated investigation summary.

**This skill invokes:** `/lookup-liberty91` (first-party — run first), `/lookup-virustotal`, `/lookup-urlscan`, `/lookup-shodan`, `/lookup-otx`, `/lookup-ransomwarelive`, optionally `/lookup-censys`, optionally `/lookup-reversinglabs` (network threat-intel from RL malware corpus), optionally `/lookup-crowdstrike` (IOC reputation + actor/malware links), optionally `/lookup-misp` and/or `/lookup-opencti` (internal correlation), optionally `/lookup-sentinel` (exposure check in your own telemetry), then `/source-assessment`, `/tlp-guide`, `/confidence-levels`.

## When to invoke

- User asks to investigate, check, or enrich a domain / hostname
- User pastes a suspicious domain and asks "what is this?"
- `/url-investigation` hands off the parent domain for deeper context
- `/ip-investigation` surfaced a hostname worth investigating

## Inputs

# DPRK Cyber Espionage Knowledge Cell

## Executive Summary

North Korea operates a uniquely structured cyber program where revenue generation and intelligence collection are equally prioritized national objectives. Most units sit under the Reconnaissance General Bureau (RGB); Japanese and U.S. authorities assess that the Contagious Interview (WaterPlum) operators and some IT workers instead operate under the 313 General Bureau of the Munitions Industry Department [24]. Chainalysis puts cumulative DPRK cryptocurrency theft at $6.75 billion through the end of 2025 [11]. The Multilateral Sanctions Monitoring Team (MSMT), which replaced the disbanded UN Panel of Experts as the main multilateral reporting body, published its first cyber and IT-worker report in October 2025 [16].

2025 was the largest year on record: Chainalysis attributes $2.02 billion in theft to the DPRK, a 51% increase on 2024 from far fewer known incidents, dominated by the $1.5 billion Bybit theft of February 2025 that the FBI attributed to TraderTraitor [9][11]. 2026 has continued at a lower but still high level. The April 2026 Drift Protocol (about $285 million) and KelpDAO (about $290 million) thefts and the 24 September 2026 Bitget theft ($351.6 million) are all assessed by blockchain analytics firms or the victims as likely DPRK operations, though none has yet been formally attributed by a government. If Bitget is confirmed, 2026 theft exceeds $1 billion [19][20][21][22][23].

Three trends define the period since early 2025. First, developer and open-source targeting has become the main access route: the Contagious Interview fake-interview campaign infected at least 30,000 devices in more than 100 countries between December 2025 and July 2026, and the March 2026 compromise of the axios npm package showed that DPRK operators can hijack packages with more than 100 million weekly downloads [17][18][24]. Second, the IT-worker scheme has drawn sustained enforcement (a coordinated U.S. action in June 2025, sanctions in March 2026, multinational alerts in July and September 2026) while expanding beyond the United States and adopting AI tools for identity fraud [13][14][15][24]. Third, espionage units continue to invest in capability: Lazarus used a Windows zero-day in its 2026 Operation Dream Job wave against defense firms, and Kimsuky compromised South Korean software vendors to reach their customers [26][27].

## Key Actors

Vendor naming overlaps heavily and "Lazarus Group" is often used as an umbrella term for several units. Aliases below are those confirmed in the cited reporting.

# Feedback Loops

Feedback is Phase 6 of the CTI Hyperloop. Without it, the cycle is open-ended and quality degrades over time.

## Types of Feedback

### 1. Consumer Feedback
Intelligence consumers (stakeholders) assess the value of products they receive.

**Collection points:**
- After every significant product delivery
- During quarterly PIR reviews
- During stakeholder briefings

# GreyNoise API

## Base URL
- Community: `https://api.greynoise.io/v3/community`
- Enterprise: `https://api.greynoise.io/v3`

## Authentication
Header: `key: $GREYNOISE_API_KEY`

## Rate Limits
- Community (free): 50 requests/day
- Enterprise: Based on plan

## Key Endpoints

# Hacktivism

## Executive Summary

Hacktivism in 2025-2026 is driven by two conflicts: Russia's war against Ukraine and the confrontation between Iran, Israel and the United States. Activity tracks military and political events closely. Radware recorded a peak in public DDoS claims in Q2 2025, a contraction afterwards, and a 103% month-over-month jump in March 2026 following the US and Israeli strikes on Iran that began on 28 February 2026 [19][20]. Europe receives roughly half of all claimed hacktivist DDoS attacks, and government is the most targeted sector [19][20].

The question of whether the main pro-Russian brands are grassroots or state-run has largely been answered by governments. In December 2025 the US Department of Justice and a joint advisory from CISA, FBI, NSA and international partners stated that Cyber Army of Russia Reborn (CARR) was created and funded by the GRU, and that NoName057(16) was created by CISM, an organization established on behalf of the Kremlin [11][12]. Denmark's Defence Intelligence Service assessed that Z-Pentest and NoName057(16) both have links to the Russian state and are used as instruments of hybrid war [13]. On the Iranian side, vendors describe Handala as linked to the Ministry of Intelligence and Security (MOIS) and Cyber Av3ngers as affiliated with the IRGC [17][23].

Law-enforcement pressure increased but has not stopped the activity. Europol's Operation Eastwood (July 2025) took more than 100 NoName057(16) servers offline and produced two arrests and seven arrest warrants; Imperva measured a few days of silence followed by a higher attack tempo [9][10]. NoName057(16) remained the most active DDoS-claiming group through the first half of 2026 [19]. The United States extradited and indicted one alleged CARR and NoName057(16) participant, Spain arrested an alleged supporter, and Dutch investigators seized 800 servers from hosting companies linked to the group's infrastructure [11][14][15].

Most hacktivist operations still have limited effect, and the groups routinely exaggerate. The joint advisory says pro-Russian groups have limited capabilities and regularly make false or exaggerated claims [12]. The exception is tampering with internet-exposed operational technology (OT). Confirmed cases now include burst water pipes in Denmark, a dam valve opened in Norway, and manipulated water pressure in Canada, all achieved through weak or default credentials rather than sophisticated tooling [13][21][22]. Anonymous Sudan remains disrupted following the October 2024 US indictment; no later activity was found in this refresh.

## Key Actors

# hash-investigation

Investigate a file hash end-to-end. Chain lookups, surface malware family attribution, prioritize infrastructure pivots, and decide whether deeper malware analysis is warranted.

**This skill invokes:** `/lookup-liberty91` (first-party — run first), `/lookup-virustotal`, `/lookup-otx`, optionally `/lookup-reversinglabs` (vendor-authoritative classification + MITRE ATT&CK + sandbox), optionally `/lookup-crowdstrike` (Falcon Intel verdict + actor/malware attribution), optionally `/lookup-misp` and/or `/lookup-opencti` (internal correlation), optionally `/lookup-sentinel` (exposure check in your own telemetry), optionally `/malware-analysis`, then `/source-assessment`, `/tlp-guide`, `/confidence-levels`.

## When to invoke

- User asks to check a hash, identify malware, or enrich a sample
- Another skill surfaces a hash during investigation (e.g., `/ip-investigation` found communicating files)
- User asks "what is this malware" with a hash as input

## Inputs

# Horizon Scanning

Horizon scanning identifies emerging threats, opportunities, and developments that could impact the organisation's security posture in the medium to long term (6-24 months).

## Process

### 1. Define Scope
- Time horizon (6 months? 12 months? 24 months?)
- Focus areas (specific sectors, threat types, geographies)
- Stakeholder needs (what decisions will this inform?)

### 2. Identify Weak Signals
Weak signals are early indicators of emerging trends. Sources:
- Academic research and conference papers (BlackHat, DEF CON, CCC, academic journals)

# Indicator Pivoting

Pivoting is the art of using one known indicator to discover related infrastructure, expanding a single seed into an understanding of an adversary's wider operations. Each pivot is a directed-graph walk: the node is an indicator (typed), the edge is a relation derived from a lookup, and the cost is one or more API calls plus the analyst time to interpret the result.

This skill is the canonical "how to walk the IOC graph" reference. The four investigation skills (`/ip-investigation`, `/domain-investigation`, `/hash-investigation`, `/url-investigation`) chain a fixed set of lookups for a known seed type; this skill takes over when you need to keep walking past their first-hop output.

**This skill invokes:** `/lookup-liberty91`, `/lookup-virustotal`, `/lookup-otx`, `/lookup-shodan`, `/lookup-censys`, `/lookup-urlscan`, `/lookup-abuseipdb`, `/lookup-greynoise`, `/lookup-misp`, `/lookup-opencti`, `/lookup-ransomwarelive`, `/lookup-crowdstrike`, `/lookup-reversinglabs`; then `/score-source`, `/apply-tlp`, `/confidence-language`. May hand off to `/threat-actor-profiling`, `/campaign-tracking`, `/malware-analysis`, `/yara-writing`, `/sigma-writing`, `/darkweb-collection`.

## When to invoke

- The user has a single seed IOC and asks "what else is related to this?"
- An investigation skill returned `pivot_candidates` and you need to walk further than its routing did
- You suspect a campaign cluster (multiple indicators in incident telemetry) and want to confirm common infrastructure
- A threat-actor profile mentions an indicator and you want to see the wider footprint

# Infostealers

## Executive Summary

Infostealer malware remains a foundational enabler for ransomware, account takeover, corporate network intrusion, and financial fraud. The families operate under a Malware-as-a-Service (MaaS) model: developers sell subscriptions that include a builder, a management panel, and regular updates to evade detection. Upon execution, infostealers harvest browser-stored credentials, session cookies, cryptocurrency wallet data, autofill data, and system information, packaging the results into "logs" that are sold on marketplaces, traded on Telegram, or used directly by the operator.

Between May 2025 and June 2026 the three families that led the market after RedLine's 2024 disruption were each hit by coordinated action: Lumma (May 2025, Microsoft, US DOJ, Europol and JC3), Rhadamanthys (November 2025, Operation Endgame), and StealC together with the Amadey loader (June 2026, Operation Endgame) [9][10][17][21][22]. None of these actions announced an arrest of a stealer developer. The results differ by family. Lumma rebuilt after the May 2025 seizures, then lost customers after rivals doxxed its alleged core members between late August and October 2025; it remains in circulation at reduced standing [13][14][28]. Rhadamanthys' developer attempted a revival about three weeks after the takedown, without new releases [19]. The post-takedown state of StealC is not yet established in the sources reviewed.

The market is now fragmented. Vidar, relaunched as version 2.0 in October 2025, absorbed much of the displaced demand [13][15][19]. Acreed rose on Russian Market during 2025 [11][12]. Newer names, including Remus, RevStealer and a set of macOS stealers (MacSync, Shub Stealer, DigitStealer), appear in 2026 vendor reporting [25][26][27][29]. Russian Market continues to operate, but Flare reports that more than 90% of the stealer logs it sees are now found on Telegram [28]. BidenCash was seized by US authorities in June 2025 [31].

Delivery has shifted towards ClickFix: fake verification or troubleshooting pages that persuade the user to paste and run a command. Microsoft describes campaigns hitting thousands of devices daily and, in 2026, macOS variants that fingerprint visitors before showing the lure [23][24][25]. The infostealer-to-ransomware link through Initial Access Brokers (IABs) is unchanged, while the value of a log has widened: Flare found enterprise SSO or identity-provider credentials in 2.05 million of 18.7 million logs analysed for 2025, and in 2026 stolen sessions for AI services became a reported monetisation path [28][32][33].

## Key Actors

# Initial Access Brokers

## Executive Summary

Initial Access Brokers (IABs) are specialized cybercriminal actors who gain unauthorized access to corporate networks and sell or hand that access to other threat actors, most commonly ransomware and data-extortion crews. They decouple the intrusion phase from the monetization phase, which lets buyers skip the slowest part of an attack. The model is unchanged; the venues, the prices and the way vendors track brokers all changed materially between 2025 and 2026.

The forum landscape the market relied on has been broken up. The alleged administrator of XSS was arrested in Kyiv on 22 July 2025 and the forum's clear-web domains were seized; a site under the XSS name returned under a new administrator, but former moderators left to found DamageLib and trust in XSS has not recovered [9][10][11]. BreachForums lost its domains to an FBI seizure in October 2025 and has since split into competing successors [12]. RAMP, the one major forum that openly permitted ransomware advertising, was seized by the FBI on 28 January 2026 and its administrator said he would not rebuild it [13][14]. Of the three forums this cell previously named as the core venues, only Exploit is still operating without a known disruption. Ransomware actors have dispersed to newer forums such as Rehub and T1erOne rather than consolidating on one successor, and both XSS and Exploit have restated their bans on ransomware activity [13].

Pricing data is vendor-specific and the two most recent Rapid7 datasets are not directly comparable. For the second half of 2024 Rapid7 reported an average base price of just over $2,700 across Exploit, XSS and BreachForums, with nearly 40% of offers priced between $500 and $1,000 [15][16]. For 2025, with DarkForums and RAMP added to the dataset, Rapid7 reported an average base price of $113,275, which it attributes largely to very high-value listings on DarkForums [17]. Most listings bundle a privilege level with the access vector: 71.4% in the 2024 data, and domain admin in roughly a third of 2025 listings that stated a privilege [16][17].

Vendor reporting increasingly describes brokers that never post a public listing. Cisco Talos proposed splitting "initial access groups" into financially motivated, state-sponsored and opportunistic categories [18]. Reporting in 2026 describes access operations tied directly to specific extortion programs: the FortiBleed credential-harvesting operation linked to INC Ransom and Lynx [22], a broker affiliated with Payouts King [23], and Microsoft-tracked Storm-3121, whose voice-phishing access leads to ShinyHunters and Falcon extortion [24]. The infostealer log pipeline and exploitation of internet-facing appliances remain the two main supply mechanisms, with social engineering of identity and SaaS access now a third.

## Key Actors

# Intelligence Sharing

## Why Share?

Intelligence sharing creates a network effect — threats identified by one organisation protect the entire community. However, sharing must be governed, reciprocal, and risk-managed.

## Sharing Models

### 1. ISACs (Information Sharing and Analysis Centers)
Sector-specific sharing communities.

| ISAC | Sector | URL |
|------|--------|-----|
| FS-ISAC | Financial Services | fs-isac.com |

# Intelligence Writing Guide

Intelligence writing is not creative writing. It is precise, structured, and audience-driven. Every word must earn its place.

## Core Principles

### 1. Bottom Line Up Front (BLUF)
The most important finding goes in the first paragraph. If the reader stops after two sentences, they should have the key takeaway.

**Bad**: "Over the past several months, we have observed various indicators that suggest a potential shift in threat actor targeting patterns across multiple sectors..."

**Good**: "APT41 is actively targeting European pharmaceutical companies using a new loader variant. We assess with high confidence that at least three organisations in this sector have been compromised since January 2026."

### 2. Active Voice

# IOC Enrichment Workflow

This workflow defines how to enrich raw indicators of compromise by routing them to the appropriate `/lookup-*` skills and synthesising results.

**Seeding the queue (optional):** when you don't already have a batch but want fresh leads, `/lookup-crowdstrike indicators --malicious --since 7d [--type … | --actor …]` returns the latest high-confidence CrowdStrike IOCs (newest-first). Feed the returned indicators into the per-type routing below to enrich each. Requires CrowdStrike credentials with the Indicators read scope.

**This skill invokes:** `/lookup-liberty91`, `/lookup-virustotal`, `/lookup-abuseipdb`, `/lookup-greynoise`, `/lookup-shodan`, `/lookup-otx`, `/lookup-censys`, `/lookup-urlscan`, `/lookup-misp`, `/lookup-opencti`, `/lookup-reversinglabs`, `/lookup-crowdstrike`, optionally `/lookup-ransomwarelive`, optionally `/lookup-sentinel` (exposure sweep of the confirmed-malicious subset against your own telemetry); then `/score-source`, `/apply-tlp`, `/confidence-language`. For deeper graph traversal, hands off to `/indicator-pivoting`.

## Enrichment routing by IOC type

### IPv4/IPv6 address

| Order | Skill | What to extract |
|-------|-------|----------------|

# IOC Export Guide

## Supported Export Formats

### CSV
Standard tabular format. Most broadly compatible.

```csv
indicator,type,first_seen,last_seen,confidence,access_level,claim_support,tlp,source,source_url,context,mitre_attack,tags
203.0.113.42,ipv4-addr,2026-01-15,2026-03-20,70,direct,firm,GREEN,"Mandiant report MAL-2026-001",https://vendor.example.com/mal-2026-001,C2 server for SUNBURST variant,T1071.001,"apt29;sunburst"
evil.example.com,domain-name,2026-02-01,2026-03-20,50,limited,tentative,GREEN,"Internal analysis",,"Phishing landing page",T1566.002,"phishing;apt29"
```

**Column definitions:**

# ip-investigation

Investigate an IP address end-to-end. Chain multiple `lookup-*` skills, consolidate results, prioritize follow-up IOCs, and return a rated investigation summary. You invoke skills — you don't call APIs directly.

**This skill invokes:** `/lookup-liberty91` (first-party — run first), `/lookup-virustotal`, `/lookup-shodan`, `/lookup-abuseipdb`, `/lookup-greynoise`, `/lookup-otx`, optionally `/lookup-censys`, optionally `/lookup-reversinglabs` (network threat-intel + sample fan-out), optionally `/lookup-crowdstrike` (IOC reputation + actor/malware links), optionally `/lookup-misp` and/or `/lookup-opencti` (internal correlation), optionally `/lookup-sentinel` (exposure check in your own telemetry), then `/source-assessment`, `/tlp-guide`, `/confidence-levels`.

## When to invoke

- User asks to investigate, check, or enrich an IP
- User pastes an IP and asks "what is this?" / "is this malicious?"
- Another skill hands off an IP indicator for follow-up
- IOC triage pipeline

## Inputs

# Iran Cyber Espionage Knowledge Cell

## Executive Summary

Iran's state-sponsored cyber operations are conducted primarily by two organizations: the Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence and Security (MOIS). IRGC-affiliated groups (APT33, APT35/APT42, Nimbus Manticore/UNC1549, Imperial Kitten, CyberAv3ngers) cover espionage against defense, aerospace and policy targets and attacks on operational technology. MOIS-affiliated groups (APT34/OilRig, MuddyWater, Scarred Manticore, Void Manticore, Cavern Manticore) run sustained espionage against government, telecom and IT providers in the Middle East, and, through Void Manticore's Handala Hack persona, destructive and hack-and-leak operations.

Since this cell was seeded, Iranian cyber activity has been shaped by two wars. During the June 2025 Israel-Iran conflict, US agencies warned of possible Iranian activity against US networks but stated they had not seen a coordinated campaign [10]. Iran itself was the victim of destructive attacks claimed by Predatory Sparrow against Bank Sepah and the Nobitex exchange [11][12]. On 28 February 2026 the United States and Israel began a joint offensive against Iran (Operation Epic Fury / Operation Roaring Lion) [13][14]. A ceasefire announced on 7 April 2026 was declared over on 9 July 2026 [14]. This second conflict brought highly disruptive Iranian-linked activity against US organizations: the 11 March 2026 wipe of Stryker Corporation's managed devices, claimed by Handala [15][16][17], and exploitation of internet-exposed PLCs in US water, energy and government facilities [18][19].

Three shifts stand out. First, destructive operations no longer depend on wiper malware: the Stryker incident used the built-in wipe function of a cloud endpoint management platform [17], and Void Manticore also wipes by hand over RDP or with legitimate disk-encryption software [15]. Second, MOIS actors have retooled. MuddyWater moved from broad abuse of remote management tools to a series of custom backdoors, including Rust implants with Telegram command and control [20][21][22][23]. Third, vendors report AI-assisted malware development by MuddyWater, Void Manticore and Nimbus Manticore [15][23][25]. Long-running social engineering by APT35/APT42 and fake-recruiter operations against aerospace and defense continue [24][25][26][27][28]. US law enforcement and sanctions action against Iranian operators resumed in August 2026 [29][30].

## Key Actors

Status reflects public reporting opened for the 2026-09-29 refresh. "Not confirmed" means no 2025-2026 primary reporting was reviewed, not that the actor is inactive.

# Key Assumptions Check

Every analytical judgment rests on assumptions — often unstated. This technique surfaces them and evaluates whether the analysis holds if assumptions are wrong.

## Procedure

### Step 1: State the Analytical Line
Write the current assessment or conclusion in one clear sentence.

### Step 2: List All Assumptions
Brainstorm every assumption underlying the assessment. Include:
- Assumptions about threat actor intent or capability
- Assumptions about data completeness or accuracy
- Assumptions about the relevance of historical patterns

# KQL Writing Guide — Microsoft Sentinel

KQL (Kusto Query Language) is used in Microsoft Sentinel, Microsoft Defender, and Azure Data Explorer for querying security logs and building detection rules.

## Core Syntax

### Table references
```kql
SecurityEvent                        // Windows Security Events
DeviceProcessEvents                  // Defender for Endpoint
DeviceNetworkEvents                  // Network connections
DeviceFileEvents                     // File operations
EmailEvents                         // Defender for Office 365
SigninLogs                           // Azure AD sign-ins

# Likelihood Language — Probability Yardstick

Every forward-looking assessment (prediction, forecast, risk statement) MUST use standardised likelihood language. Never use vague terms like "could", "might", or "may" without mapping them to a probability band.

## The Yardstick

| Term | Probability Range | Usage |
|------|------------------|-------|
| **Almost certain** | >95% | Use sparingly. Reserved for near-inevitable outcomes with overwhelming evidence. |
| **Highly likely** | 75-95% | Strong evidence supporting the assessment. Limited plausible alternatives. |
| **Likely** | 50-75% | The weight of evidence supports this outcome, but meaningful alternatives exist. |
| **Realistic possibility** | 25-50% | Plausible outcome that cannot be discounted. Evidence is mixed or limited. |
| **Unlikely** | 15-25% | Possible but not supported by the weight of evidence. |
| **Highly unlikely** | 5-15% | Very limited evidence suggests this outcome. Most evidence points elsewhere. |

# lookup-abuseipdb

Queries AbuseIPDB for IP reputation data. IP addresses only (v4 and v6). Retrieval only — do not interpret.

## When to invoke

- User asks about abuse reports for an IP
- Investigation skill needs community-reported abuse context
- Triaging whether an IP has a history of malicious behavior

## How to invoke

Two CLIs are provided. Pick by capability needed:

# lookup-censys

Queries Censys for host and certificate reconnaissance on IPs, or runs a Censys Search query. Retrieval only. Quota-aware — free tier is 250 queries/month.

## When to invoke

- Shodan wasn't sufficient and deeper host data is needed
- TLS certificate pivoting (find other hosts sharing a cert)
- Specific Censys Search query required

**Do NOT invoke for:**
- Bulk enrichment (will exhaust quota)
- IPs you can get from Shodan first

# lookup-crowdstrike

Queries the CrowdStrike Falcon Intelligence (Intel) API for indicator (IOC) reputation, threat-actor (adversary) profiles, actor search by origin/target, MITRE ATT&CK technique coverage, and finished intelligence reports. Retrieval only — do not interpret, assess, or conclude. The invoking skill or agent reasons about the result.

## When to invoke

- User asks to look up an IP / domain / hash / URL and CrowdStrike credentials are configured — return CrowdStrike's malicious-confidence, linked actors, malware families, and report references alongside the other lookups
- User asks for the latest / recent malicious IOCs, a CrowdStrike indicator feed, or "what's CrowdStrike seeing lately" → `indicators --malicious` (browse/sweep, newest-first; filter by type/actor/malware/recency)
- User asks "what TTPs / techniques does <actor> use?" → `ttps <actor>` (MITRE ATT&CK mapping)
- User asks "which threat actors operate from <country>?" / "who targets <sector>?" → `actors --origin <c>` / `--target-industry <i>`
- User asks to profile a named adversary (Charming Kitten, Mustang Panda, Cozy Bear, …) → `actor <name>`
- User wants the latest finished reporting on an actor or topic → `reports --actor <name> --latest` or `reports --search "<topic>"`
- `/threat-actor-profiling` or a regional espionage cell wants vendor-authoritative attribution, origins, motivations, and capability
- Need to download a specific intel report PDF by ID → `reports --pdf <id>`

# lookup-greynoise

Queries GreyNoise to classify whether an IP is internet background noise (opportunistic scanners, search engines, etc.) or targeted. IP-only. Retrieval only.

## When to invoke

- User asks if an IP is scanner noise or targeted
- Investigation skill wants to filter out mass-scanning IPs from indicator lists
- Deciding if an IP hitting your perimeter is worth investigating

## How to invoke

Two CLIs are provided. Pick by capability needed:

# lookup-liberty91

Two-way bridge to the [Liberty91](https://liberty91.com) platform — the pack's only **first-party** integration. Where VirusTotal or Shodan answer *"what is known about this indicator"*, Liberty91 answers *"what happened, who reported it, how well corroborated is it, and which of my organizations does it touch"*.

Like `/lookup-misp` and `/lookup-opencti`, this skill **also writes**: it ingests your own reports, queues intelligence packages, and manages organization profiles. Writes publish into your Liberty91 account and are metered — **confirm with the user before invoking any write command**, and never run one inside an autonomous enrichment loop.

## The two-layer model — read this first

Everything else follows from it.

- A **Threat Event** is a real-world occurrence: one breach, one exploitation campaign, one leak. Deduplicated, with every source you are entitled to attached.
- An **Event** is one *report about* an occurrence. A breach covered by a vendor write-up, three news articles and a leak-site post is **five Events and one Threat Event**.

| You want | Command |

# lookup-misp

Two-way bridge to a MISP threat-intelligence platform. Unlike the other `lookup-*` skills, this one **also writes** — it can create events, add attributes, tag events, and import STIX 2 bundles. Treat write commands as deliberate actions; don't use them in autonomous enrichment loops.

## When to invoke

**Read:**
- An indicator was found by another lookup (VT, OTX, …) — check whether MISP already has it
- An analyst wants the most recent published events for a threat actor or campaign
- You need to export a slice of MISP as a STIX 2 bundle for sharing

**Write:**
- A finished investigation produced indicators that should be shared with the community
- An existing event needs to be enriched with newly observed attributes

# lookup-opencti

Two-way bridge to an [OpenCTI](https://filigran.io/solutions/open-cti/) threat-intelligence platform. OpenCTI is a STIX 2.1-native knowledge base: everything in it — indicators, observables, intrusion sets, malware, reports, campaigns — is a STIX entity connected by relationships. Like `/lookup-misp`, this skill **also writes**: it can create indicators and observables, label and TLP-mark entities, relate them, and import STIX 2.1 bundles. Treat write commands as deliberate actions; don't use them in autonomous enrichment loops. The `delete` command is destructive — **always confirm with the user before invoking it**.

## When to invoke

**Read:**
- An indicator was found by another lookup (VT, OTX, …) — check whether your OpenCTI instance already knows it (`lookup`)
- An analyst wants the entities, reports, or campaigns your platform holds on an actor, malware family, or CVE (`search`, `list`, `get`)
- You need recent high-score indicators, this quarter's incidents, or everything carrying a given label (`list` with filters)
- You want to verify connector health or instance version (`connectors`, `version`)

**Write:**
- A finished investigation produced indicators that belong in your knowledge base

# lookup-otx

Queries AlienVault OTX for community pulse context on IPs, domains, file hashes, and URLs. Retrieval only — do not interpret results.

## When to invoke

- User asks what pulses reference an indicator
- Investigation skill needs community context (who's tracking this?)
- IOC enrichment pipeline is adding pulse metadata

## How to invoke

Two CLIs are provided. Pick by capability needed:

# lookup-ransomwarelive

Queries ransomware.live's PRO API for victim claims, group profiles, IOCs, YARA rules, ransom notes, negotiation chats, and CSIRT contacts. Retrieval only — the invoking skill or agent reasons about the result. Note that **leak-site claims are claims, not confirmed breaches** (see Source reliability below).

## When to invoke

- An investigated domain or organisation should be checked against ransomware leak-site claims
- Profiling a ransomware group — pull description, TTPs, tools, vulnerabilities, leak-site `.onion` infrastructure
- Sector- or country-level ransomware briefing (e.g., "all NL victims claimed in 2026")
- Detection engineering for a specific group — fetch its public YARA rules + IOC dump
- Updating the `/ransomware-ecosystem` knowledge cell with the current top-N groups by victim count
- Incident response: looking up a country's CSIRT/CERT contact list

**Do NOT invoke for:**

# lookup-reversinglabs

Queries ReversingLabs Spectra Analyze (the A1000 appliance API) for authoritative classification, full enrichment reports, sandbox behaviour, MITRE ATT&CK mappings, and network indicator reputation. Retrieval only — do not interpret, assess, or conclude. The invoking skill or agent reasons about the result.

## When to invoke

- User asks to check a hash against ReversingLabs / A1000 / Spectra Analyze
- VirusTotal returned thin signal on a hash and you need a vendor-validated verdict
- Investigation needs MITRE ATT&CK technique coverage from a sample's behaviour
- Need parent/child relationships (which container did this drop from? what was unpacked?) for pivoting
- Want to find sibling samples by threat name or AV-detection signature (`/lookup-reversinglabs search`)
- Need network reputation on a URL, domain, or IP from RL's malware-analysis corpus
- Submitting a sample for fresh static + dynamic analysis (slower; produces a full TitaniumCore + sandbox report)

# lookup-sentinel

Query bridge to the organisation's own Microsoft Sentinel (Azure Log Analytics) workspace. Every other lookup in this pack asks the world about an indicator; this one asks **your own telemetry**: *has this indicator been seen in our environment? Is this ATT&CK technique's behaviour present in our logs?* It is scoping/exposure-checking, not enrichment — chain it **after** external lookups have told you what an indicator is, to establish whether it touched you.

Read-only. The CLI can only run queries and list schema — it cannot modify the workspace, close incidents, or create analytics rules.

## The cardinal rule: discover before you query

**No two Sentinel workspaces have the same tables.** Table availability follows deployed connectors (Defender for Endpoint brings `Device*`, Entra ID brings `SigninLogs`, AMA/CEF brings `CommonSecurityLog`, …). A query referencing an absent table fails outright; worse, a hunt written for tables the environment doesn't ingest silently proves nothing.

So, in every session, before generating any hunt KQL:

1. Run `tables` (schema-known) and/or `ingestion` (actually receiving data) once, and reuse the result for the rest of the session.
2. `probe` the specific candidate tables for the hunt — schema-known tables can be empty.

# lookup-shodan

Queries Shodan for host reconnaissance data on IPs. For domains, resolves DNS first then queries the resolved IP. Retrieval only — do not interpret results.

## When to invoke

- User asks what ports/services an IP exposes
- Investigation skill needs infrastructure fingerprinting
- Vulnerability scan context (CVEs on exposed services)

## How to invoke

Two CLIs are provided. Pick by capability needed:

# lookup-urlscan

Submits URLs to URLScan.io for live scanning and retrieves results. For domains, searches existing scans first (uses cached scan if <24h old, else submits new one). Retrieval only — do not interpret.

## When to invoke

- User asks to scan a URL or check what a domain renders as
- Investigation skill needs redirect chain, contacted infra, or a visual snapshot
- Triaging a potentially malicious URL before clicking

## How to invoke

Two CLIs are provided. Pick by capability needed:

# lookup-virustotal

Queries VirusTotal API v3 for reputation data on IPs, domains, file hashes, and URLs. Retrieval only — do not interpret, assess, or conclude. The invoking skill or agent reasons about the result.

## When to invoke

- User asks to check an IP, domain, hash, or URL against VirusTotal
- Investigation skill needs reputation context for a collected indicator
- IOC enrichment pipeline is deduplicating + scoring a batch

## How to invoke

Two CLIs are provided. Pick by capability needed:

# Malware Analysis Guide

This skill provides analytical guidance for understanding malware samples. It does NOT execute malware — it tells you what to look for in analysis reports, sandbox results, and VirusTotal data.

## Static Analysis

### PE Header Analysis
- **Compilation timestamp**: When was it compiled? Anomalous dates suggest timestomping.
- **Sections**: Unusual section names (not .text/.data/.rss/.reloc) suggest packing or custom builders.
- **Entropy**: High entropy (>7.0) in sections suggests encryption or compression (packed).
- **Imports**: Key suspicious imports indicate behavior:

| Import | Indicates |
|--------|----------|

# CTI Programme Maturity Assessment

## Maturity Levels

| Level | Name | Description |
|-------|------|-------------|
| **1** | Ad-hoc | No formal CTI function. Reactive, incident-driven. Intelligence is incidental. |
| **2** | Emerging | Basic CTI capability. Some collection, limited analysis. Primarily tactical (IOC feeds). |
| **3** | Defined | Formal CTI function with documented processes. Strategic, operational, and tactical output. PIRs defined. |
| **4** | Managed | Mature CTI programme. Stakeholder-driven, measured effectiveness, feedback loops. Proactive intelligence. |
| **5** | Optimized | Intelligence-driven organisation. CTI informs all security decisions. Continuous improvement, advanced analytics, community contribution. |

## Assessment Dimensions

# MITRE ATT&CK Local Reference

## Dataset
Local file: `mitre-attack/enterprise-attack.json` (~45 MB STIX 2.1 bundle).

**First use — if the file is missing**, run the bundled download script before any query:

```bash
./scripts/download-mitre.sh
```

The script is idempotent (skips if the file is already present) and supports `--force` for refresh. If `scripts/download-mitre.sh` is not present in the install (e.g. for plugin-only deployments), fall back to:

```bash

# OSINT Collection Methodology

## Collection Planning

Before collecting, define:
1. **Objective**: What specific intelligence do we need?
2. **Scope**: What sources are relevant? What's out of scope?
3. **Keywords**: Search terms, aliases, IOCs to look for
4. **Time constraints**: How recent must the intelligence be?
5. **Documentation**: How will findings be recorded?

## Source Categories

| Category | Sources | Best For |

# AlienVault OTX API

## Base URL
`https://otx.alienvault.com/api/v1`

## Authentication
[Credential-related source omitted]

## Rate Limits
- 10,000 requests/hour

## Key Endpoints

### IPv4 Indicator

# Phishing & Social Engineering

## Executive Summary

Phishing and social engineering remain among the most common initial access vectors across both cybercriminal and state-sponsored operations. Microsoft's 2025 Digital Defense Report attributes 28% of the breaches its incident responders investigated to phishing or social engineering [39]. The defining change since 2024 is that attackers increasingly avoid stealing a password at all. Three techniques now sit alongside Adversary-in-the-Middle (AitM) session theft: device code phishing, where the victim authorizes an attacker's device on the genuine Microsoft sign-in page; ClickFix, where a fake CAPTCHA or error page talks the victim into pasting and running a command; and voice phishing, where a caller posing as the IT help desk walks an employee through handing over access. All three defeat non-phishing-resistant MFA, and the consistent vendor recommendation is FIDO2/passkey authentication, restriction of the device code flow, and managed-device requirements.

The Phishing-as-a-Service (PhaaS) market was the target of four major disruptions in twelve months: RaccoonO365 (September 2025), Tycoon 2FA (March 2026), the China-based Outsider kit (June 2026) and EvilTokens (September 2026) [10][17][19][34]. Results were mixed. Tycoon 2FA, which Microsoft says accounted for about 62% of the phishing attempts it blocked by mid-2025, lost 330 domains but was back at pre-disruption volume within days according to CrowdStrike, and by late April 2026 had added device code phishing [10][11][13]. Outsider affiliates stood up more than 700 new phishing pages in the month after the takedown [33]. EvilTokens, launched in February 2026, turned device code phishing into a commodity and bundled an AI assistant that triaged stolen mailboxes for payment fraud; its disruption was accompanied by two arrests in the UK, and it is too early to judge whether it holds [18][19]. Subscription prices observed in 2025-2026 range from $289 per month (Greatness) to a $1,500 entry fee plus $500 per month (EvilTokens) [19][23].

Business Email Compromise (BEC) remains the second most costly crime type reported to the FBI IC3, behind investment fraud: $3.05 billion in reported losses from 24,768 complaints in 2025, up from $2.77 billion in 2024 [9]. Voice-led extortion crews (UNC6040, UNC6671 and clusters using the ShinyHunters name) have made help-desk impersonation a routine route into Salesforce, Microsoft 365 and Okta tenants [28][29][30]. Law enforcement pressure on Scattered Spider has been substantial, with two members sentenced in the UK in July 2026 [36]. AI use is now documented in kit features and lure production, but measured losses attributed to AI remain a small share of the total [9].

## Key Actors

| Actor/Platform | Type | Notable Characteristics | Status |
|---------------|------|------------------------|--------|

# Priority Intelligence Requirements (PIR) Management

PIRs are the foundation of relevant intelligence. They define what stakeholders need to know and drive all collection and analysis priorities. Without PIRs, a CTI team produces intelligence nobody asked for.

## What is a PIR?

A PIR is a question that, when answered, directly supports a stakeholder's decision-making. PIRs are:
- **Stakeholder-driven** — not what the analyst finds interesting
- **Decision-oriented** — answering them enables action
- **Bounded** — specific enough to collect against
- **Reviewable** — can be assessed for satisfaction

## PIR Format (SMART)

# Quality Control Standards

## Review Process

1. All products must be reviewed before moving to "published" status
2. Reviews are performed by the quality-reviewer agent
3. Products with CRITICAL issues are returned for revision
4. Products with 3+ MAJOR issues are returned for revision
5. MINOR issues are noted but don't block publication
6. Evidence validation runs before the checklist. A product that fails it is returned without being scored.

## Evidence Validation

This is the enforcement point for `/claim-extraction` and `/quality-of-information-check` output, and for any product built on it (`/ach`, `/threat-assessment`, `/writing-assessments`). The schema is in `skills/quality-of-information-check/references/evidence-item-schema.md`. The caps are rules R1 to R13 in `skills/quality-of-information-check/references/grading-rubric.md`.

# quality-of-information-check

Grade the evidence before you reason about it.

A structured analytic technique run by prompt alone produces output that has the shape of the technique and none of its discipline. An ACH matrix built on whatever the model felt like trusting is worse than no matrix, because it looks rigorous. This skill is the step that comes first: it establishes what the evidence is, where it came from, and how much weight each claim can bear.

**Composition.** Invokes `/source-provenance`, then `/claim-extraction`, then applies the rubric, then hands to `/quality-control`. Optionally invokes `/lookup-*` skills for corroboration and `/lookup-liberty91` for platform data. Its output is the preferred input of `/ach`, `/threat-assessment` and `/writing-assessments`, and is consumed by `/key-assumptions-check`, `/intelligence-writing`, `/stix-bundle` and `/ioc-export`.

## Three principles

1. **Grade provenance chains, not outlets.** The grade belongs to this claim arriving by this chain. The same outlet carries a vendor's own telemetry finding and an attacker's boast in the same week.
2. **Grade claims, not events.** One report contains observations, attributions and assessments of very different standing. One grade for all of them is meaningless.
3. **Data does the research, the model applies the rubric.** The chain is resolved by the platform or by a script. Corroboration is counted from data. What is left for the model is labelled as model judgement.

# Ransomware Ecosystem

## Executive Summary

The ransomware ecosystem operates predominantly through a Ransomware-as-a-Service (RaaS) model, where operator groups develop and maintain ransomware payloads, negotiate with victims, and manage leak sites, while affiliates — independent contractors — handle the actual intrusion, lateral movement, and deployment. This division of labor has driven the industrialization of ransomware since roughly 2019, enabling groups to scale operations far beyond what a single team could achieve. Revenue sharing typically follows a 70/30 or 80/20 split favoring the affiliate, though elite affiliates can negotiate better terms. The double-extortion model (encrypting data AND threatening to leak it) is now standard, with some groups pursuing triple extortion by adding DDoS threats or contacting victims' customers directly.

Law enforcement pressure has been continuous since 2023: Hive (January 2023), LockBit in Operation Cronos (February 2024), Phobos/8Base (February 2025), BlackSuit in Operation Checkmate (July 2025), and in 2026 a shift toward shared criminal infrastructure, with the First VPN anonymization service (May 2026) and the AudiA6 laundering service (June 2026) taken down [14][16][25][26]. Groups have also collapsed from the inside. ALPHV/BlackCat exit-scammed in March 2024, Black Basta dissolved after its internal chats leaked in February 2025, and RansomHub, the leading brand of 2024, went offline on 1 April 2025 and has not returned [11][12][18]. None of this reduced volume. Displaced affiliates moved to other programs and new brands filled the gaps.

Payments and attack volume have decoupled. Chainalysis tracked about $820 million in on-chain ransomware payments in 2025, down 8% from a revised $892 million in 2024, while claimed incidents rose about 50% to an all-time high [9]. Fewer victims pay: Chainalysis puts the 2025 payment rate at roughly 28%, Coveware reported a record-low rate in Q2 2026, with only 15% of data-exfiltration-only victims paying, and Check Point cites approximately 23% [9][10][22]. Those who do pay are paying more, with the median on-chain payment rising from $12,738 to $59,556 in 2025 [9].

As of September 2026 the ecosystem is more fragmented than at any earlier point. Check Point counted 93 active groups in Q2 2026, a record for its tracking, with the top ten accounting for 57.6% of leak-site victims, down from 71% in Q1 [22]. Qilin has been the most prolific brand for four consecutive quarters, The Gentlemen (emerged mid-2025) is close behind, and Akira, Play, INC Ransom, SafePay and DragonForce remain consistently active [22][24][27]. LockBit returned with version 5.0 in September 2025 [19][20]. Social-engineering-led intrusion (help-desk impersonation, vishing, Teams phishing) has become a leading route to extortion, used by Scattered Spider, Chaos, Silent Ransom and former Black Basta operators [10][17][18][21]. Healthcare, education, manufacturing, and critical infrastructure remain heavily targeted sectors.

## Key Actors

# ReversingLabs Spectra Analyze (A1000) API

This is reference documentation. The agent-invokable lookup skill is `/lookup-reversinglabs`; the runtime CLI is `tools/clis/reversinglabs.py`. Read this file when the lookup skill's options are not enough and you need to know which raw endpoint to hit, what fields a response carries, or how to construct a query the SDK does not expose directly.

## Base URL

Default: `https://a1000.reversinglabs.com`. Override with `REVERSINGLABS_HOST` for on-prem or alternate-tenant appliances. The path prefix is `/api/`.

## Authentication

Token-based. Two paths:

[Credential-related source omitted]
[Credential-related source omitted]

# Russia Cyber Espionage Knowledge Cell

## Executive Summary

Russia maintains one of the most capable and aggressive state-sponsored cyber operations programs globally, distributed across three primary intelligence services: the GRU (military intelligence), SVR (foreign intelligence), and FSB (federal security service). GRU units run the most disruptive and destructive operations and the largest credential-theft campaigns. The SVR conducts long-term espionage against governments, diplomats and cloud identity systems. The FSB runs both high-volume operations against Ukraine (Gamaredon) and selective, long-lived espionage (Turla, Center 16 network-device intrusions, Star Blizzard).

The war in Ukraine remains the center of gravity. ESET reporting covering October 2024 to March 2026 describes Sandworm deploying a succession of new wipers (ZEROLOT, Sting and others) against Ukrainian energy, government, logistics and grain-sector targets, and Gamaredon as the most active group targeting Ukraine [10][11][12]. APT28 has spent more than two years targeting Western logistics and technology companies that move aid to Ukraine [9], and Ukrainian drone manufacturers are now a recurring target for both GRU and SVR-linked operators [12][25].

Three developments since early 2025 change the picture. First, destructive activity reached a NATO member: on 29 December 2025 wipers and attacks on industrial devices hit more than 30 wind and solar farms, a combined heat and power plant and a manufacturer in Poland [14]. Attribution is contested. ESET attributes the DynoWiper malware to Sandworm with medium confidence [13], CERT Polska reports infrastructure overlap with the FSB-linked cluster known as Static Tundra or Berserk Bear [14], and in July 2026 the UK and EU member states formally attributed the attack to FSB Center 16 [15][16]. Second, Russian services are increasingly working from the network path rather than the endpoint: Turla uses an ISP-level adversary-in-the-middle position inside Russia against embassies [26], APT28 hijacked DNS on compromised home and small-office routers [35], and a Midnight Blizzard sub-cluster manipulated hotel and conference Wi-Fi captive portals [24]. Third, Western governments have moved against the ecosystem around the services: Operation Eastwood against NoName057(16) in July 2025 [39], US indictments and a joint advisory on GRU-supported hacktivist fronts in December 2025 [37][38], a US disruption of the APT28 router network in April 2026 [35], and coordinated UK and EU sanctions in July 2026 [15][17].

Cooperation between units is now documented rather than assumed. ESET assesses with high confidence that Gamaredon provided access to Turla on machines in Ukraine in 2025 [27]. A previously unknown actor, Void Blizzard (Laundry Bear), was exposed in May 2025 and was the subject of a 24-agency advisory in July 2026 [32][33].

## Key Actors

# Shodan API

## Base URL
`https://api.shodan.io`

## Authentication
Query parameter: `?key=$SHODAN_API_KEY`

## Rate Limits
- Free: 1 request/second, 100 results/search
- Paid: Higher limits and more features

## Key Endpoints

# SIGMA Rule Writing Guide

SIGMA rules are vendor-agnostic detection rules written in YAML. They can be converted to platform-specific query languages (Splunk SPL, Elastic KQL, Microsoft Sentinel KQL, etc.).

## Rule Structure

```yaml
title: Descriptive title of the detection
id: <UUID>                          # Generate a unique UUID
status: experimental|test|stable
description: >
    Detailed description of what this rule detects and why.
references:
    - https://reference-url.com     # Source intelligence, blog posts, CVE

# Standard Operating Procedures

## SOP-001: Daily Intelligence Triage

**Frequency**: Daily
**Owner**: Orchestrator

1. Review overnight intelligence feeds and alerts
2. Check active PIRs — any new information relevant to Critical/High PIRs?
3. Triage new indicators:
   - Discard noise (known benign, low confidence, duplicate)
   - Fast-track critical indicators (active exploitation, direct relevance)
   - Queue remaining for standard processing
4. Dispatch OSINT researcher for any trending threats relevant to PIRs

# Source & Information Assessment — NATO Admiralty Scale

Every piece of intelligence entering this platform MUST be assessed using the Admiralty Scale. This is non-negotiable. Tag every item with a two-character code (e.g., B2). Claims from documents are the exception: they carry the evidence grade instead, see below.

## How this differs from the evidence grade

The pack uses two instruments. They are not the same and neither is converted into the other.

- **Admiralty reliability is the source's track record**: how often it has been right before. The evidence grade's **access level** is how the source knows the particular thing claimed.
- **Admiralty is a letter and a number** (B2). **The evidence grade is two words**, access level then claim support ("direct, firm").
- **Documents, articles and reports are graded per claim** by `/quality-of-information-check` with the evidence grade. Lookup results and single items are rated here, on the Admiralty scale.

## Scope of This Skill

# source-provenance

Most CTI reporting that reaches an analyst is derivative. An outlet rewrites another outlet, which summarised a vendor blog, which reported on the vendor's telemetry. Five outlets covering one vendor report look like five sources. They are one.

This skill resolves a URL to its originating source and returns the chain as data. It does not grade anything. Grading is `/quality-of-information-check`.

**Composition.** Invokes `/lookup-liberty91` when a key is configured. Invoked by `/quality-of-information-check`, `/claim-extraction` (for the fetcher), `/threat-actor-profiling`, `/campaign-tracking`, `/intelligence-writing` and `/cti-orchestrator`.

## The rule that matters

**The chain comes from data, never from recollection.** You may know that a story "was originally a Mandiant report". That knowledge does not go in the output. If the platform or the script did not resolve a hop, the hop is unresolved, and you say so.

## Inputs

# Stakeholder Management

Intelligence that doesn't reach the right person in the right format might as well not exist. This skill ensures every product is tailored to its audience.

## Stakeholder Identification

### Common CTI Stakeholders

| Stakeholder | Needs | Format | Cadence |
|-------------|-------|--------|---------|
| **CISO** | Strategic risk, business impact, investment justification | Executive summary, risk scores, trend analysis | Monthly + ad-hoc |
| **SOC Manager** | Operational context, detection priorities, hunt leads | Operational briefs, IOC packages, hunt playbooks | Weekly + real-time |
| **SOC Analysts** | Tactical indicators, detection rules, response guidance | IOCs, SIGMA/YARA rules, enriched alerts | Daily + real-time |
| **IR Team** | Campaign context, TTP detail, forensic indicators | Detailed campaign reports, investigation leads | Per-incident |

# STIX 2.1 Bundle Creation

STIX (Structured Threat Information Expression) 2.1 is the standard for representing and sharing cyber threat intelligence.

## Bundle Structure

```json
{
  "type": "bundle",
  "id": "bundle--<UUID>",
  "objects": [
    // Array of STIX Domain Objects (SDOs) and Relationship Objects (SROs)
  ]
}

# Structured Analytic Techniques (SATs) Index

SATs are formal methods that externalise analytical thinking, making it transparent, challengeable, and less susceptible to cognitive biases. Choose the right technique based on the analytical challenge.

## When to Use SATs

- When the stakes are high (wrong answer = significant consequence)
- When multiple plausible explanations exist
- When cognitive biases are likely (confirmation, anchoring, availability)
- When you need to communicate your reasoning transparently
- When building on analysis from multiple analysts

## Start With the Evidence

# Supply Chain Threats

## Executive Summary

Software supply chain attacks target the trust relationships between organizations and their software vendors, open-source dependencies, SaaS integrations, and managed service providers. Rather than attacking a target directly, adversaries compromise an upstream component — a package maintainer account, a CI/CD workflow, an update channel, an OAuth integration, or an MSP's remote management tooling — to reach many downstream victims at once. The defining incidents of 2020 to 2024 (SolarWinds, Kaseya, 3CX, MOVEit, XZ Utils) remain the reference cases, but the threat picture as of September 2026 is dominated by a different pattern: high-tempo, credential-stealing attacks on the developer ecosystem itself.

Three shifts stand out since early 2025. First, self-propagating package worms became routine. Shai-Hulud (September 2025) was described by Wiz as the first successful self-propagating attack in the npm ecosystem; it was followed by Shai-Hulud 2.0 (November 2025), the "Mini Shai-Hulud" waves attributed to TeamPCP (April to June 2026), and ChainDrop (August 2026), which infected hundreds of packages within hours. The Mini Shai-Hulud source code was published in May 2026, and Red Hat now describes the derived "Miasma" payload as an open-source malware kit, so later waves cannot be assumed to be the work of one group. Second, CI/CD became the primary entry point: the tj-actions/changed-files compromise (March 2025), the Nx "s1ngularity" incident (August 2025), the Trivy compromise (March 2026) and the TanStack compromise (May 2026) all abused GitHub Actions, and the TanStack wave produced malicious packages carrying valid SLSA Build Level 3 provenance. Third, North Korean actors moved to social engineering of maintainers of very widely used packages: Google, Microsoft and Amazon attribute the axios compromise (March 2026) to a DPRK actor tracked as UNC1069 or Sapphire Sleet.

Outside the package registries, SaaS-to-SaaS OAuth token theft emerged as a supply-chain class of its own (Salesloft Drift in August 2025, Gainsight in November 2025, Klue in June 2026), Cl0p continued its mass-exploitation model against enterprise applications (Oracle E-Business Suite in 2025, PTC Windchill in 2026), and update channels were hijacked at the infrastructure layer (Notepad++ in 2025, Virtualizor and Coder's module registry in August 2026). Registry operators have responded with time-based defenses: Dependabot now waits three days before proposing non-security version updates, and PyPI rejects new files on releases older than 14 days.

## Key Actors

| Actor | Attribution | Notable Operations | Motivation |
|-------|-----------|-------------------|------------|