The operational reality of defense requires a deep, current understanding of offensive methodologies. Hunting Off The Red transforms complex, open-source intelligence detailing adversary campaigns and red team activities into actionable defensive knowledge. This resource moves past theory to provide a foundational link between attacker techniques and practical cyber assurance.
A tiered format structures our analysis for immediate value across your entire security organization. We synthesize deeper technical articles into a tiered format, starting with strategic briefings for management and progressing into the operational and technical specifics analysts require for investigation.
This platform bridges the intelligence gap by providing the necessary technical context, culminating in AI-driven detection queries (e.g., KQL and Splunk) that allow your team to translate advanced threat knowledge directly into validated, high-fidelity security controls.
Three clusters exploit a critical Cisco Secure FMC auth bypass to drop web shells, Cyclops Blink, and Qilin ransomware.
Read Guide →
Three Russian espionage clusters abuse app passwords, OAuth device codes, and WhatsApp device linking to hijack accounts. Splunk/KQL hunts + MITRE mapping.
Read Guide →
AI-generated exploit scripts are targeting Siemens PLCs and US water utilities. Threat hunting analysis with Splunk and KQL queries plus MITRE ATT&CK mapping.
Read Guide →
How the knaithe threat actor weaponized AI to autonomously scan, exploit, and exfiltrate.
Read Guide →
Unit 42 details Pass-ta-Key attacks that steal synced passkeys.
Read Guide →
Analysis of CyberAv3ngers and IOCONTROL attacks on U.S. water and OT systems.
Read Guide →
Analysis of UNC6508's INFINITERED backdoor targeting REDCap medical research servers.
Read Guide →
Analysis of STOCKSTAY, a Turla espionage backdoor targeting Ukraine and government networks.
Read Guide →
Analysis of Microsoft's Fox Tempest malware-signing service and AI-themed malvertising delivering Vidar, with Splunk and KQL hunting queries and MITRE mapping.
Read Guide →
Analysis of the UNK_DeadDrop DPRK campaign weaponizing VS Code extensions and repos against developers, with Splunk and KQL hunting queries and MITRE mapping.
Read Guide →
Analysis of PhantomRPC Windows RPC privilege escalation with Splunk and KQL threat hunting queries.
Read Guide →
Analysis of CVE-2025-53521 and BRICKSTORM backdoor targeting F5 BIG-IP APM with Splunk and KQL hunting queries, MITRE mappings, and behavioral indicators.
Read Guide →
Analysis of GRIDTIDE backdoor used by UNC2814 for global espionage. Splunk and Microsoft hunting queries with MITRE ATT&CK mappings and detection strategies.
Read Guide →
Analysis of VEN0m ransomware leveraging BYOVD driver exploitation
Read Guide →
Analysis of UAT-8837 China-nexus APT targeting North American infrastructure
Read Guide →
Analysis of the Notepad++ supply chain compromise targeting telecom and finance sectors.
Read Guide →
A sophisticated modular malware framework called VoidLink is purpose-built for modern cloud and container environments.
Read Guide →
Technical analysis and detection guidance for pro-Russia hacktivist campaigns targeting operational technology infrastructure via VNC vulnerabilities.
Read Guide →
Deep dive into the BADAUDIO malware distribution campaign used by Chinese APT24. Detection techniques and IOAs for multiple attack vectors.
Read Guide →
Emerging attack techniques using AI tools for data exfiltration and extortion. Detection strategies for AI-assisted intrusions.
Read Guide →
How to identify and respond to SSH-based persistent backdoors establishing Tor connectivity in government and military systems.
Read Guide →
Complete attack chain analysis for Qilin ransomware. How to identify reconnaissance, lateral movement, and encryption phases.
Read Guide →
Technical indicators for Static Tundra threat group. APT tactics, techniques, and detection methods from Talos research.
Read Guide →
How attackers abuse Microsoft Teams for command and control, data exfiltration. Hunting techniques and defensive measures.
Read Guide →
Modern attack techniques bypassing malware detection through credential theft and identity abuse. Detection without relying on malware signatures.
Read Guide →
Technical deep dive into the EtherHiding stealth malware used by UNC5342. Detection techniques for network-level evasion.
Read Guide →
How Flax Typhoon exploits ArcGIS Server vulnerabilities to establish persistent web shells. Hunting and remediation guidance.
Read Guide →
Complete analysis of Gentlemen ransomware operations. Targeted industries, delivery mechanisms, and detection strategies.
Read Guide →
Detailed exposure of TA415 intelligence gathering operations. Tools, techniques, and indicators for detecting espionage campaigns.
Read Guide →
Analysis of Premier Pass abuse in APT collaboration networks. How to identify shared infrastructure and coordinated campaigns.
Read Guide →
How attackers abuse CAPTCHA mechanisms in phishing campaigns. Detection techniques for fake verification pages and credential harvesting.
Read Guide →