Threat intel, DFIR
and security notes
Deep-dives, investigation write-ups, tooling notes and transparent product updates from the Mlab team. Written for analysts who want the indicators, the method and the fix.
#threat-actors
Newest first
From IOC to Adversary: Attribution Basics for Blue Teams
How analysts get from a single indicator to a named adversary: activity clustering, infrastructure overlap, malware lineage, false flags, and why defenders should care more about how than who.
The Vulnerabilities Threat Actors Actually Exploit
Attackers do not exploit CVEs at random. Cross-referencing actor profiles with their known exploited vulnerabilities reveals clear patterns you can use to prioritize patching.
Threat Actor Naming Hell: APT28, Fancy Bear, or STRONTIUM?
The same Russian intrusion set answers to at least eight names. Why vendors refuse to share a naming scheme, how each taxonomy works, and how to keep your own alias registry sane.
A 421M decision model in front of our MCP output? Not yet
Studies, benchmarks and build notes. Method first, numbers included, losses too.
Read the latest note