Cyber Threat Intelligence Courses & Training Insights

Expert articles on cyber threat intelligence, OSINT, HUMINT, information security, Linux forensics, and attack surface management. Free guides and training resources.

• ARTEX AI Pentest Framework: What Our Security Audit Found: ARTEX, the autonomous AI pentest framework tied to Storm-0940 and attacks on Korean and Japanese com
• Vulnerability Prioritization: What to Patch First: A CVSS-sorted patch queue puts the wrong flaws first. This practitioner guide ranks the threat intel
• PHP2Shell, Explained for Threat Intelligence Teams: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) drew an exploit attempt four days before disclosure.
• Certificate Transparency: A Practical Guide for Defenders: In October 2026 Google disclosed that attackers who hijacked three country-code domains had obtained
• Threat Intelligence Analyst Interview Questions and Answers: Real threat intelligence analyst interview questions with short model answers, from the intelligence
• Cyber Threat Landscape 2026: Where the Reports Disagree: Microsoft says the median time from discovery in the wild to weaponization is well under 24 hours, w
• ShinyHunters: Aliases, Attacks and the 2026 Arrests: ShinyHunters is less a fixed gang than an extortion brand that vendors track under half a dozen name
• Device Code Phishing: How EvilTokens Hit 12,000+ Inboxes: Device code phishing lets an attacker take over a Microsoft 365 mailbox while the victim signs in on
• Cyber Threat Intelligence Training 2026: Courses and Certs: A practitioner's guide to cyber threat intelligence training in 2026: the free courses worth your ti
• North Korean IT Workers: Laptop Farms and Fake Interviews: On 18 September 2026 seven agencies from Japan, the US, Australia and Germany linked North Korean IT
• Bitget Hack: How Suspected Lazarus Hackers Took $387.5M: Bitget lost $387.5 million without losing a single private key. A compromised wallet backend spoofed
• Threat Actor Naming, Decoded: Why APT29, Cozy Bear, and Midnight Blizzard Are One Problem: In July 2026 Google renamed its entire catalogue, and APT29 became ICE RELIC. It already answered to
• The CTI & EASM Job Market in 2026: What 1,000 Job Postings Actually Show: We scanned 1,000 cybersecurity job postings and went deep on 214 CTI and 54 EASM listings to find ou
• Infostealer Malware, Explained: How Stolen Logs Get Used: An infostealer does not break anything, it runs once, copies what the browser already remembered, an
• Sock Puppet Accounts: How OSINT Analysts Build Personas: Most research accounts are not burned by clever adversaries, they are burned by the analyst who made
• Living Off the Land: Why Attackers Prefer Your Own Windows Tools: There is no malware in a living off the land intrusion. No implant, no dropper, no new file for anti
• Entry-Level CTI Jobs: Where to Find Them and How to Land One: Ninety percent of organizations now have dedicated threat intelligence resources, and most of those
• How to Write a Threat Intel Report Nobody Ignores: How to write a threat intelligence report people actually act on: the BLUF method, the so-what test,
• The 4 Types of Threat Intelligence, Explained: Threat intelligence comes in four types: strategic, operational, tactical, and technical. Learn what
• Bulletproof Hosting and the Money Mule Ecosystem, Explained: One bulletproof hosting provider sanctioned in late 2025 had been serving attackers since 2015, outl
• Most Common Psychological Tactics Used in Social Engineering Attacks: In 2025, a threat group went from a single help-desk phone call to full domain administrator access
• Threat Intelligence Analyst Salary 2026: $70K to $220K: A global 2026 salary guide for threat intelligence analysts: real US, UK, Europe, India, UAE, Singap
• The Ransomware-as-a-Service Business Model, Explained: How the RaaS business model actually works in 2026: the operator/affiliate revenue split, why power
• SOC Analyst vs CTI Analyst: Which Cybersecurity Career Fits You?: Ask ten CISOs where they started, and eight will say some version of a security operations center. S
• Traffic Light Protocol: TLP RED, AMBER, GREEN, CLEAR: The fastest way to get quietly cut out of an information sharing community is not leaking something.
• Best Threat Intelligence Books, Ranked by a Practitioner: The threat intelligence books that actually matter in 2026: the CTI core every analyst should read f
• ClickFix, Explained: The Attack That Turns Users Into the Payload: There is no exploit in a ClickFix attack. The victim runs the malware themselves, copying a command
• Telegram as a Cybercrime Marketplace: Telegram is not the dark web, but its communication, marketplace, automation, and amplification laye
• The Initial Access Broker Ecosystem, Explained: How the initial access broker economy actually works: the supply chain from infostealer logs to rans
• How to Become a CTI Analyst in 2026: A practitioner's roadmap to becoming a cyber threat intelligence analyst in 2026: what the job actua
• Malware Command and Control (C2) Explained: Command and control (C2) is the communication channel a threat actor uses to remotely operate compro
• OSINT: The Complete Guide: Open Source Intelligence (OSINT) is the practice of collecting, analyzing, and acting on information
• Attack Surface Management (ASM) Guide: Attack Surface Management (ASM) is the continuous process of discovering, cataloging, and securing a
• Introduction to Information Security: Every organization, from global enterprises to small startups, depends on digital infrastructure. Wi
• What Is Cyber Threat Intelligence? Real Examples (2026): Most teams collect plenty of threat data. Far fewer change a decision with it. This guide explains w
• What Is HUMINT in Cybersecurity?: HUMINT, or Human Intelligence, is the collection of information through interpersonal contact and hu
• Linux for Cyber Threat Analysis: When a security incident strikes, the analysts who respond fastest are almost always the ones workin