Sources & Methods

Less than 3 hours left until our OCCRP Briefing | New Sanctions Evasion Playbook.

Don't forget to sign up to join us2.campaign-archive.com?u=8a7b7dd3a0...

We should use Clue (1986) to explain Analysis of Competing Hypotheses to incoming analysts.

Bellingcat Stage Talk, Thursday 31/07, 5pm CEST/11am EDT Discord.com/invite/bellingcat , Detecting Stolen Art with Art Detective Arthur Brand

Want to learn what goes into finding stolen art? On Thursday at 5pm CEST /11am EDT we'll be joined by @artdetective.bsky.social , the citizen art detective behind the recovery of over 200 pieces of art including lost Picasso, Van Gogh and Dali works. Join us live for Q&A discord.gg/2fMCucQ5?eve...

As I watched infostealers encounters rise I wrote this guide for @esetresearch.bsky.social on the recovery process: www.welivesecurity.com/en/cybersecu...

There can be real costs for #ransomware. 'Alpha Medical Centre has been the victim of a serious cybersecurity attack. As a result of this criminal act and its devastating impact, we have no choice but to close the practice.' databreaches.net/2025/07/22/t... #cybersecurity @gate15.bsky.social

So this is as good a time as I’ll ever get to explain what I think is the difference between “software supply chain compromise” and “operational enablement” when it comes to cyber operations. It’s very easy to lump these two together, especially since they are both means of access development (1/x)

Open Position Career Opportunity: Volexity is currently looking to hire Senior Threat Intelligence Analyst to join its rapidly growing services team.

@volexity.com is looking to grow our Threat Intelligence team. New job posting for Senior Analyst role is up here:

www.volexity.com/company/care...

If you have any questions, don't hesitate to ask.

Standard Chartered Threat Intelligence team is looking for a new colleague who will help us with task automation, and particularly squeezing out even more juices from The Vertex Project Synapse platform we are using. 1/2

CYBERWARCON is back! Save the date for Wednesday, November 19, 2025, in Arlington, VA + virtually.

Follow us to stay up to date for CFPs, volunteer opportunities + more!

Check out for more information + sponsorship opportunities >> www.cyberwarcon.com

Tap in to the stream this week for some YARA fun, highlighting some crazy rules, how I think about learning yara (or anything) as a mid-career professional, and more!

State of Statecraft (SOS) is a new security and intelligence conference that brings together experts on espionage, sabotage, influence, and other unique forms of covert statecraft to share their work with a community hyper-focused on tackling state-sponsored operations.

Looks like the maintainer of a number of highly-popular npm packages was phished through npnjs[.]com, and his access used to publish malicious versions of their packages

x.com/JounQin/stat...

www.linkedin.com/feed/update/...

github.com/prettier/esl...

a man in a black shirt and tie is holding a pen and a notebook and says you 're on my list ALT: a man in a black shirt and tie is holding a pen and a notebook and says you 're on my list

Tonight's the night! The ATT&CKcon 6.0 CFP will automatically stop accepting submissions at 8pm ET tonight. Historically we get about half of our submissions today, so all you procrastinators are in good company.

Give it your best shot at openconf.org/ATTACKCON2025.

A tweet from @JimmySecUK that reads: “If you're wondering why the SBU are being so open about the methodology behind today's attack; imagine the impending disruption to Russian logistics as the FSB are forced to double check a few million cargo containers for Ukrainian surprises...”

This offensive counterintelligence effect is an oft-overlooked, knock-on benefit of a successful operation that involves compromising an adversary’s security. It psychologically degrades the target after the fact, forcing them to expend extra resources and attention just to regain some peace of mind

🕵️ ARCA is pleased to be collaborating with @bellingcat.com for it's first ever series of OSINT art crime challenges.Test your open source research skills with these challenges, unlocking new ones by completing the previous one in the series.

challenge.bellingcat.com

Last week to get your @SLEUTHCON tickets!

Sources & Methods Newsletter #24 - June 2025 Well we're nearly half-way through 2025. 😮‍💨 Kicking off June sharing a new tool of my own, synapse-claude, and looking forward to SLEUTHCON this Friday! I'll be attending remotely and suffering from ...

Sources & Methods #CTI newsletter issue 24 is out with more articles, tools, and conferences for you 📨 sourcesmethods.com/sources-meth...

Is the era of the “named actor” done?

As the OG adversary sets diverge, get promoted, or move on

actors dispersing across the kill chain based on specialized skills increases (ORBs, criminal underground)

AND the CTI models maturing…

APTs ⬇️⬇️

UNCs ⬆️⬆️

Screenshot of Obsidian 1.9.0 showing a base with a list of books

Introducing Bases, a new core plugin that lets you turn any set of notes into a powerful database. With Bases you can organize everything from projects to travel plans, reading lists, and more.

Bases are now available in Obsidian 1.9.0 for early access users.

If you’ve been laid off from a cyber intel position, please reach out if you’d like to come to @sleuthcon.bsky.social.

The final agenda is here!

Check it out & plan your day at #SLEUTHCON!

There's still time to buy your ticket too. Check it all out on our website.

www.sleuthcon.com

Engineering Manager, Security Automation & Incident Response, United States - Careers at HashiCorp Join our team and help us build industry-leading products that are redefining how enterprises are running their IT infrastructure.

HashiCorp Threat Detection & Response is expanding 🎉 Now hiring an Engineering Manager for Security Automation & Incident Response 🕵️‍♂️ #DIFR #hiring www.hashicorp.com/career/6759554

Sources & Methods Newsletter #23 - March 2025 📁 Sources What is this Stealer - Here's a collection of examples of credential stealer information formats, and accompanying YARA rules to help you automatically match on stealer logs and determine t...

Sources & Methods #CTI newsletter issue 23 is out with more articles, tools, and conferences for you 📨 sourcesmethods.com/sources-meth...

Ирина Волк ⭐️ Мои коллеги из УБК МВД России совместно с сотрудниками профильных подразделений из Саратовской, Тульской и Ульяновской областей пресекли деятельность по созданию и распространению вредоносного прог...

Russian Interior Ministry announces arrests in multiple oblasts of 3 developers of the Mamont banking Trojan for Android as part of a criminal case for computer fraud and unauthorized access. Swift action on malware that appeared just last year.
t.me/IrinaVolk_MVD/3860

Bellingcat is Hiring: Open Source Investigator and Trainer (Conflict) - bellingcat Bellingcat is hiring an open source investigator and trainer (conflict). Find out more about the role and apply within.

We're hiring! Bellingcat is looking for an Open Source Investigator and Trainer to join our Human Rights and Conflict Monitoring team. Read about the role and apply here: www.bellingcat.com/bellingcat-i...

The EU has released its 3rd EEAS Report on Foreign Information Manipulation and Interference (FIMI)

The report maps out digital infrastructure deployed by foreign actors, mainly by Russia, but also by China.

www.eeas.europa.eu/eeas/3rd-eea...

👀 Looking to level up your intelligence analysis capabilities?

Check out our blog and join the Synapse Slack community to connect with peers in the field!

🔗 vertex.link/blog

#ThreatIntelligence #CTI #threatintel

Registration — SLEUTHCON

Important reminders:
📢 CFP closes on April 18th—don’t wait!
🎟️ Early bird ticket prices go up soon.
⚡This conference WILL sell out, so grab your ticket now!

www.sleuthcon.com/registration

3/x

🐍 SLEUTHCON is coming! 🐍

Registration and CFP are now open for this year’s SLEUTHCON—happening June 6th, both in-person in Arlington, VA, and virtually.

www.sleuthcon.com

1/x

Detecting and Mitigating the “tj-actions/changed-files” Supply Chain Attack (CVE-2025-30066) On March 14, 2025, StepSecurity uncovered a compromise in the popular GitHub Action tj-actions/changed-files. Tens of thousands of repositories use this

Audit the source of GitHub Actions code you use and pin them to a specific commit SHA. Specifying a tag is not enough, since those can point to malicious code later, which happened to all versions of tj-actions/changed-files sysdig.com/blog/detecti...