Cyber Intelligence Hub

Reduce your cyber risk and enhance your security posture with our expert resources. We provide the intelligence and strategies you need to protect your organization from evolving cyber threats.
AllCTICybercrimeDark Web
KELA blog banner: php2shell underground response, what cybercriminals are saying about the leaked PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619, beside a php2shell exploit request
CTI

October 22, 2026

php2shell: How the Underground Is Responding to the Leaked PHP RCE VulnerabilitiesWithin two days of the php2shell leak, KELA recorded roughly 150 forum, paste and social media posts and over 110 Telegram messages about CVE-2026-109618 and CVE-2026-109619. This analysis covers proo
Silent Ransom Group Chat Leak Analyzed: A Reason for Sleepless Nights
CTI

October 13, 2026

Silent Ransom Group Chat Leak Analyzed: A Reason for Sleepless Nights KELA's Cyber Intelligence Center analyzed 5,692 leaked internal chats attributed to the Silent Ransom Group (SRG/Luna Moth). This blog explains why the group persists, why US is a primary focus, what
Prompt injection prevention: separating AI reading from AI action
GenAI Security

October 7, 2026

How to Prevent Prompt Injection: 6 Enterprise Best PracticesProduction generative AI workflows face critical vulnerabilities against indirect prompt injection when operating without strict context isolation and schema validation. Implementing multi-layered arc
Blog banners - Dark AI & Enterprise Risk_ How to Defeat Malicious GenAI Models (1).png
GenAI Security

September 21, 2026

Dark AI & Enterprise Risk: How to Defeat Malicious GenAI ModelsDark AI services are increasingly used across phishing, social engineering, reconnaissance, malware development, fraud, and impersonation. These capabilities increase the speed, scale, and personaliza
Stealer logs and data breaches: proactive defense
Risk Protection

September 16, 2026

Stealer Logs and Data Breaches: How to Build a Proactive DefenseStealer logs are structured files of credentials, session cookies, and payment data harvested from infected devices. They let attackers sign in as your users instead of breaking in. This guide covers
Revolut data breach extortion site infrastructure analysis
Cybercrime

September 15, 2026

Revolut Data Breach: Tracing the Extortion Site InfrastructureRevolut confirmed on 12 September 2026 that it disclosed customer files to a third party who submitted fraudulent information requests from a legitimate government agency email domain. A threat actor
TeamPCP: When the scanner is the attacker
Threat Actor Spotlight

September 12, 2026

TeamPCP (UNC6780): From Telegram Data Broker to Supply Chain CascadeTeamPCP, (UNC6780), evolved from a Telegram-based stolen data broker into the actor behind a supply chain cascade that has compromised Trivy, Checkmarx KICS, LiteLLM, and hundreds of downstream packag
CVE-2026-27825 Means We Need to Talk About KEV...and CVE, and CVSS...
Security Operations

September 10, 2026

CVE-2026-27825 Means We Need to Talk About KEV...and CVE, and CVSS...CVE-2026-27825 (CVSS 9.1) was patched on February 24, 2026, and published on the NVD on March 10. Six days later, KELA analysts found a working proof-of-concept exploit circulating on XSS.PRO, a major
Integrity Technology Group data leak analysis
Threat Landscape

September 8, 2026

Alleged Integrity Technology Group Data Leak: A Botnet, and a Purchase OrderIn August 2026, a threat actor advertised a dataset said to have been stolen from Integrity Technology Group, a Beijing security vendor sanctioned by the United States and the European Union, and four