@onyphe.io

🚨 𝗗𝗲𝗳𝗲𝗻𝗱𝗲𝗿𝘀 – 𝗦𝗵𝗶𝗻𝘆𝗛𝘂𝗻𝘁𝗲𝗿𝘀 𝗜𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 𝗔𝗹𝗲𝗿𝘁 ReliaQuest Threat Research has identified a newly registered domain: 𝘀𝘁𝗿𝘆𝗸𝗲𝗿[.]𝗽𝗮𝘀𝘀𝗸𝗲𝘆𝘀𝗲𝘁𝘂𝗽[.]𝗰𝗼𝗺, attempting to exploit confusion around Stryker’s current situation. Link: reliaquest.com/blog/threat-sp… Further investigation reveals two additional organizations being targeted: 𝘀𝘄𝗶𝗻𝗲𝗿𝘁𝗼𝗻[.]𝗽𝗮𝘀𝘀𝗸𝗲𝘆𝘀𝗲𝘁𝘂𝗽[.]𝗰𝗼𝗺 𝗰𝗯𝗶[.]𝗽𝗮𝘀𝘀𝗸𝗲𝘆𝘀𝗲𝘁𝘂𝗽[.]𝗰𝗼𝗺 ⚠️ Defenders are strongly advised to: - Monitor the generic, non-brand domains listed in the IOCs. - Deploy defensive threat monitoring queries immediately to detect potential activity. Let’s stay ahead of adversaries.🤝 #Cybersecurity #ThreatIntel #ShinyHunters

New blog post and call for collaboration and sharing around "Using NetBIOS names for pivoting and threat clustering" I'm already tracking more than 40 clusters and growing... c-apt-ure.blogspot.com/2025/10/using-…

🆕 Quick Pivot on UNC6201 infrastructure with @TeamCymru Scout! @Mandiant shared a GRIMBOLT C2: 149.248.11.71 in their latest blog on UNC6201 (cloud.google.com/blog/topics/th…) Using Scout, I found 2 more IPs using the same certificate, ASN, and open ports 140.82.18.134 66.42.111.219

📣 ANNOUNCEMENT: we have reached the 2,100+ scanned ports milestone, at Internet scale with a weekly refresh rate. Next step: 5,000+ ports, weekly refresh. Then 10,000 by end of next year. We will be the competitor number 1 to @censysio in 2026. #ASM #CTI #ASD