Cyber Intelligence Hub

Reduce your cyber risk and enhance your security posture with our expert resources. We provide the intelligence and strategies you need to protect your organization from evolving cyber threats.

All CTI Cybercrime Dark Web

OilRig

July 22, 2026

Iran's APTs and the U.S. Enterprise in 2026: APT34 (OilRig)Post 5 of 5. APT34 is Iran's most technically mature espionage operation. A decade of refinement turned it into a group that barely needs malware: it takes your credentials, your Exchange server, and

Prince of Persia

July 22, 2026

Iran's APTs and the U.S. Enterprise in 2026: Prince of Persia (Infy)Post 4 of 5. How a group that has survived takedowns, sinkholes and dormancy since 2007 reinvents itself faster than the industry can publish on it, and why, when researchers finally mapped its live v

APT42

July 22, 2026

Iran's APTs and the U.S. Enterprise in 2026: APT42 Post 3 of 5. How an IRGC-subordinated espionage group spends weeks building trust on LinkedIn and WhatsApp before it sends a single malicious link, and why its most effective intrusions increasingly l

MuddyWater

July 22, 2026

Iran's APTs and the U.S. Enterprise in 2026: MuddyWater Post 2 of 5 - How a MOIS-subordinated espionage group with a reputation for moderate technical sophistication came to target U.S. banking, a major U.S. airport, and, according to public reporting, a J

Iran APT

Threat Actor Spotlight

July 22, 2026

Iran's APTs and the U.S. Enterprise in 2026: A Strategic Shift You Can No Longer Outrun Post 1 of 5. Series introduction. How four state-aligned threat groups (MuddyWater, APT42, Prince of Persia, and APT34) moved from regional espionage to hybrid operations, and why their 2025-26 campai

Banner for KELA's blog on Exilio404, a Portuguese-language dark web forum hosting carding, money mule and malware activity targeting Brazil.

July 19, 2026

Inside Exilio404: Brazil's Underground Cybercrime Scene Exilio404 is a Portuguese-language dark web forum that emerged in May 2025 and now hosts thousands of posts on carding, phishing, malware and money mule operations targeting Brazil. This blog examines

ByteToBreach: A Deep Dive into a Persistent Data Leak Operator

Threat Actor Spotlight

July 17, 2026

ByteToBreach: A Deep Dive into a Persistent Data Leak Operator KELA uncovers ByteToBreach, a technically skilled cybercriminal selling sensitive global data from airlines, banks, and governments. This profile reveals his tactics, targets, and online identities ac

Top 10 Dark Web Search Engines: Enhance Your CTEM Discovery Strategy

July 14, 2026

Top 10 Dark Web Search Engines: Enhance Your CTEM Discovery Strategy Dark web search engines give security teams a way to surface threats that never reach Google: leaked credentials, stealer logs, and active cybercrime chatter. This guide compares the top ten, shows wh

Top 10 Telegram Log & Carding Channels: A CTEM Defense Strategy

July 13, 2026

Top 10 Telegram Log & Carding Channels: A CTEM Defense Strategy Major Telegram channels are fueling data theft and carding schemes. KELA helps your business track these threats and take action before they escalate.