Loading story…
Security professionals are increasingly adopting structured frameworks and advanced techniques to proactively hunt for threats before they materialize into attacks. One approach emphasizes detecting phishing infrastructure ahead of time by leveraging query-based methods to identify attacker assets, brand impersonation, and supplier spoofing, enabling defenders to disrupt campaigns before phishing emails reach their targets. These techniques, validated by threat analysts, are designed to shift organizations from a reactive to a proactive security posture, reducing the risk of successful phishing incidents.
Complementing these technical methods, new frameworks and templates are being introduced to standardize and document the threat hunting process. The PEAK Threat Hunting Framework, for example, provides a structured lifecycle—Prepare, Execute, Act with Knowledge—ensuring that threat hunts are repeatable, collaborative, and well-documented. Such frameworks help security teams maintain consistency, share insights, and improve the overall effectiveness of their threat hunting operations, making it easier to respond to evolving cyber threats.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
silentpush.com
Open sourcedispatch.thorcollective.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security professionals are increasingly leveraging advanced techniques and data-driven strategies to improve vulnerability management and threat hunting. One approach emphasizes using vulnerability data not just for compliance, but as actionable intelligence to guide detection and response efforts. By integrating asset context and business criticality with vulnerability information, organizations can prioritize threats, uncover ongoing compromises, and refine their security posture. This shift transforms traditional vulnerability scans from static checklists into dynamic tools for adversary detection and risk reduction. Complementing this, technical guides and research highlight the importance of identifying and tracking adversary infrastructure, such as Cobalt Strike command-and-control servers, using specialized queries and hunting recipes. Comprehensive pentest data further reveals persistent issues like weak configurations, unpatched software, and poor password policies, underscoring the need for continuous improvement in vulnerability management. Foundational resources, such as the CVE database, remain critical for maintaining a shared understanding of vulnerabilities and supporting effective remediation and compliance efforts.
Jul 12, 2026
The SANS 2026 Threat Hunting Survey found that **50%** of 500 cybersecurity practitioners and leaders identify inadequate data quality and quantity as their primary threat-hunting obstacle, overtaking skills shortages. Gaps in cloud logging and identity telemetry are particularly damaging because ransomware operators, nation-state actors, organized crime groups, and business email compromise actors increasingly blend into normal administration through living-off-the-land techniques. Ransomware was the threat most frequently uncovered by hunting teams, followed by BEC, nation-state activity, and insider threats. Threat-hunting program maturity also appears to be declining: only **37%** of respondents use a formal hunting methodology, and just **40%** formally measure hunt effectiveness, down from 64% in 2024. Organizations also reported weaker security improvements from hunting and reduced near-term plans to deploy AI or machine learning. CISOs should prioritize complete, standardized cloud and identity telemetry, establish repeatable hunting processes, and measure detection and remediation outcomes before expanding advanced analytics investments.
Sep 25, 2026
Bug hunting and penetration testing are essential practices in cybersecurity, focusing on identifying and mitigating vulnerabilities in software, networks, and organizational systems. Security researchers and professionals employ systematic methodologies to uncover flaws such as cross-site scripting (XSS), SQL injection, and misconfigurations, which can lead to significant security breaches if left unaddressed. The process involves both automated vulnerability scanning for surface-level issues and manual penetration testing to simulate real-world attacks and uncover deeper, more complex weaknesses. These activities are not only technical exercises but also require strong organizational policies and continuous monitoring to ensure ongoing protection. Educational resources and frameworks, such as *The Hacker Playbook 3* and the Safer Technologies 4 Schools (ST4S) assessment, provide structured guidance for both aspiring and experienced professionals. They emphasize the importance of building repeatable lab environments, conducting thorough reconnaissance, chaining exploits, and prioritizing remediation based on risk. Real-world experiences from penetration testers highlight the transition from simply finding flaws to building stronger, more resilient systems, underscoring the value of responsible disclosure and the impact of security testing on organizational defense.
Jul 12, 2026