Cyber Intelligence Hub

Reduce your cyber risk and enhance your security posture with our expert resources. We provide the intelligence and strategies you need to protect your organization from evolving cyber threats.

All CTI Cybercrime Dark Web

TeamPCP: When the scanner is the attacker

Threat Actor Spotlight

August 27, 2026

TeamPCP (UNC6780): From Telegram Data Broker to Supply Chain Cascade TeamPCP, (UNC6780), evolved from a Telegram-based stolen data broker into the actor behind a supply chain cascade that has compromised Trivy, Checkmarx KICS, LiteLLM, and hundreds of downstream packag

CRPx0 ransomware operation and affiliate service overview

August 26, 2026

CRPx0 - Threat Actor Profile CRPx0 is a rapidly expanding ransomware operation combining data theft, cryptocurrency theft, file encryption, and RaaS, with KELA linking the operation to the cybercriminal persona “MrAnon00”.

OilRig

July 22, 2026

Iran's APTs and the U.S. Enterprise in 2026: APT34 (OilRig)Post 5 of 5. APT34 is Iran's most technically mature espionage operation. A decade of refinement turned it into a group that barely needs malware: it takes your credentials, your Exchange server, and

Prince of Persia

July 22, 2026

Iran's APTs and the U.S. Enterprise in 2026: Prince of Persia (Infy)Post 4 of 5. How a group that has survived takedowns, sinkholes and dormancy since 2007 reinvents itself faster than the industry can publish on it, and why, when researchers finally mapped its live v

APT42

July 22, 2026

Iran's APTs and the U.S. Enterprise in 2026: APT42 Post 3 of 5. How an IRGC-subordinated espionage group spends weeks building trust on LinkedIn and WhatsApp before it sends a single malicious link, and why its most effective intrusions increasingly l

MuddyWater

July 22, 2026

Iran's APTs and the U.S. Enterprise in 2026: MuddyWater Post 2 of 5 - How a MOIS-subordinated espionage group with a reputation for moderate technical sophistication came to target U.S. banking, a major U.S. airport, and, according to public reporting, a J

Iran APT

Threat Actor Spotlight

July 22, 2026

Iran's APTs and the U.S. Enterprise in 2026: A Strategic Shift You Can No Longer Outrun Post 1 of 5. Series introduction. How four state-aligned threat groups (MuddyWater, APT42, Prince of Persia, and APT34) moved from regional espionage to hybrid operations, and why their 2025-26 campai

Banner for KELA's blog on Exilio404, a Portuguese-language dark web forum hosting carding, money mule and malware activity targeting Brazil.

July 19, 2026

Inside Exilio404: Brazil's Underground Cybercrime Scene Exilio404 is a Portuguese-language dark web forum that emerged in May 2025 and now hosts thousands of posts on carding, phishing, malware and money mule operations targeting Brazil. This blog examines

ByteToBreach: A Deep Dive into a Persistent Data Leak Operator

Threat Actor Spotlight

July 17, 2026

ByteToBreach: A Deep Dive into a Persistent Data Leak Operator KELA uncovers ByteToBreach, a technically skilled cybercriminal selling sensitive global data from airlines, banks, and governments. This profile reveals his tactics, targets, and online identities ac