Cyber Threat Intelligence Training Platform: For those who want to learn this field from the beginning.
We started CTI Academy because we kept seeing the same gap. Brilliant people who wanted to break into threat intelligence, blocked by courses that skipped fundamentals and certifications that tested memorization instead of skill.
Every course at CTI Academy starts at the actual beginning. No prerequisites, no jargon walls, no shame in asking basic questions. You will touch real data, follow real workflows, and learn the craft the way it is practiced.
Learn to collect, analyze, and act on threat data the way real SOC and intel teams do.
Go beyond alerts. Proactively hunt for adversaries hiding in networks using techniques pros rely on.
Open-source intelligence is more than Google dorking. Dive into social media analysis and infrastructure mapping.
Static analysis, dynamic analysis, reverse engineering. We walk you through real samples step by step.
CTI Academy is designed for learners with no prior experience. Follow a structured path from foundational concepts to real-world threat hunting workflows.
Start at Hunter I for free. Progress through Hunter IV as your skills grow.
Structured lessons, quizzes, and CTF-style challenges built around real threat scenarios.
Test your skills in duels and arena matches. Share intelligence on NullBase community.
Earn course completion certificates as you progress from Hunter I through Hunter IV.
From structured lessons for beginners to competitions and real-world research tools, every element works together seamlessly.
Follow a path end to end: modules that pair theory with hands-on CTF-style challenges, in the order they make sense. Each one builds on the last, so you always know what comes next.
Tutorials, threat breakdowns, and lessons learned from analysts working in the field.
ShinyHunters is less a fixed gang than an extortion brand that vendors track under half a dozen names. This profile maps its aliases, walks the 2020 to 2026 timeline, separates what police and the FBI have confirmed about the September and October 2026 arrests from what the group claims, and maps its help desk vishing playbook to MITRE ATT&CK and to the controls that break it.
Device code phishing lets an attacker take over a Microsoft 365 mailbox while the victim signs in on the real Microsoft page and completes MFA. How the OAuth device code flow is abused, what Microsoft disclosed about the EvilTokens platform, and how to block and detect it.
A practitioner's guide to cyber threat intelligence training in 2026: the free courses worth your time, paid options like SANS FOR578, EC-Council CTIA, CREST and Mandiant certifications compared with prices checked on the providers' own pages, and a sensible order to take them in.
Answers to what most beginners ask before joining.
Create a free account, no credit card needed, and begin Hunter I today.
