Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the Mlab team. Written for analysts who want the indicators, the method and the fix.
Articles
49
Categories
9
Tags
142
Latest
July 10, 2026
#attribution
Newest first
Threat Intelligence
From IOC to Adversary: Attribution Basics for Blue Teams
How analysts get from a single indicator to a named adversary: activity clustering, infrastructure overlap, malware lineage, false flags, and why defenders should care more about how than who.
6 min
Threat Intelligence
Threat Actor Naming Hell: APT28, Fancy Bear, or STRONTIUM?
The same Russian intrusion set answers to at least eight names. Why vendors refuse to share a naming scheme, how each taxonomy works, and how to keep your own alias registry sane.
6 min
Engineering
A 421M decision model in front of our MCP output? Not yet
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note