Cyber Intelligence Hub

Reduce your cyber risk and enhance your security posture with our expert resources. We provide the intelligence and strategies you need to protect your organization from evolving cyber threats.

All CTI Cybercrime Dark Web

Infrastructure Destruction Squad & BLACKNET-00: The Rise of a Hybrid Hacktivist-Ransomware Threat

Threat Actor Spotlight

May 27, 2026

Infrastructure Destruction Squad & BLACKNET-00: The Rise of a Hybrid Hacktivist-Ransomware Threat The Infrastructure Destruction Squad, is a hybrid threat actor blending hacktivism with cybercrime. They recently launched the $300 BLACKNET-00 ransomware builder alongside critical infrastructure exp

Inside The Gentlemen Leak: How a New RaaS Captured 10% of 2026’s Global Ransomware Victims

Threat Actor Spotlight

May 14, 2026

Inside The Gentlemen Leak: How a New RaaS Captured 10% of 2026’s Global Ransomware Victims KELA’s deep dive into the 2026 Gentlemen Ransomware leak. See how they used Black Basta’s playbook and AI vibe-coding to become the world's #2 RaaS operation.

a magnifying glass with the words kela on it

Threat Actor Spotlight

March 26, 2026

Law enforcement seizes Leakbase The Event: Operation Leak dismantling a major hub

The High Price of Poor OPSEC: Inside the r1z Initial Access Broker Case

Threat Actor Spotlight

January 21, 2026

The High Price of Poor OPSEC: Inside the r1z Initial Access Broker Case The r1z case shows how initial access brokers monetize firewall exploits and enterprise access at scale, while the actor’s OPSEC failures leave long-term attribution trails that expose the ransomware

a picture of a dragon head on a white background

Threat Actor Spotlight

December 7, 2025

Ransomware Threat Actor Profile: Qilin This comprehensive analysis examines the Qilin ransomware-as-a-service group, which has emerged as a major cyberthreat since 2022. The post documents their aggressive campaign from August-September 20

ByteToBreach: A Deep Dive into a Persistent Data Leak Operator

Threat Actor Spotlight

November 17, 2025

ByteToBreach: A Deep Dive into a Persistent Data Leak Operator KELA uncovers ByteToBreach, a technically skilled cybercriminal selling sensitive global data from airlines, banks, and governments. This profile reveals his tactics, targets, and online identities ac

Threat Actor 303 Exposed: Many Faces, One Hacker

Threat Actor Spotlight

November 3, 2025

Threat Actor 303 Exposed: Many Faces, One Hacker KELA uncovers the many identities of a prolific cybercriminal known as “303,” linking hundreds of forum posts, Telegram accounts, and breaches across continents. The investigation exposes his tactics,

Top 10 Telegram Channels: Logs and Carding

Threat Actor Spotlight

September 25, 2025

Top 10 Dark Web Telegram Channels Major Telegram channels are fueling data theft and carding schemes. KELA helps your business track these threats and take action before they escalate.

Who Is the Qilin Ransomware Group

Threat Actor Spotlight

August 25, 2025

Who Is the Qilin Ransomware Group and How Do They Operate?Qilin ransomware attacks are a growing threat, with high-profile incidents and sophisticated tactics. This post breaks down how the group operates, recent breaches linked to them, and what practical s