Loading story…
Splunk's Boss of the SOC (BOTS) competition, now in its 10th year, has become a key platform for security professionals to develop incident response skills and advance their careers. The event simulates real-world attack scenarios, including AI and insider threat challenges, and has led to direct career progression for participants. BOTS continues to serve as both a training ground and a recruitment tool within the cybersecurity industry.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
osintteam.blog
Open sourceosintteam.blog
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A range of cybersecurity job openings are currently available across multiple organizations, including roles such as Cybersecurity Threat Intelligence Analyst, Application Security Engineer, BISO, and Cloud Security Engineer. These positions emphasize responsibilities like vulnerability scanning, incident analysis, risk assessment, and the implementation of security controls in diverse environments such as IT, OT, DeFi, Web3, and cloud infrastructures. Employers are seeking candidates with skills in threat intelligence, application security, risk management, and cloud security, with some roles highlighting the integration of AI tools and collaboration with business units to enhance security posture. In addition to job opportunities, cybersecurity leadership is evolving to prioritize empathy, curiosity, and continuous learning. Myke Lyons, CISO at Cribl, exemplifies this trend by drawing on his unconventional background in the culinary industry to foster a security culture that values mentorship, learning from diverse experiences, and using empathy to guide incident response and team development. This approach underscores the importance of hiring for potential and adaptability, rather than solely technical credentials, and encourages a supportive environment where security incidents are treated as learning opportunities rather than failures.
Jul 12, 2026
Open Source Intelligence (OSINT) has become a cornerstone in both offensive and defensive cybersecurity operations, with hackers and defenders alike leveraging publicly available data to gain critical insights. Successful hackers dedicate a significant portion of their efforts to reconnaissance, meticulously gathering, mapping, and analyzing information before attempting any exploit. This process often involves scouring social media, public records, metadata, and other online breadcrumbs to uncover sensitive details, such as credentials inadvertently exposed in photographs or documents. The art of OSINT is not limited to espionage or government operations; it is a practical, everyday tool for penetration testers, red teamers, and even cybercriminals seeking high-value targets. For example, a security assessment revealed a corporate password visible in a Facebook photo, underscoring how seemingly innocuous digital footprints can become major vulnerabilities. OSINT practitioners employ a variety of techniques, including advanced search queries, metadata analysis, and social engineering, to piece together attack paths that may bypass traditional security controls. Defenders, on the other hand, use OSINT to identify their own exposure, monitor for leaked information, and anticipate potential attack vectors. The growing sophistication of OSINT tools and methodologies has led to its integration into Security Operations Centers (SOCs), where it supports threat detection, incident response, and executive protection. Training resources, webinars, and professional communities now focus on enhancing OSINT skills, reflecting its rising importance in the cybersecurity landscape. Corporate security teams are increasingly adopting OSINT-driven approaches to due diligence, threat management, and risk assessment. The proliferation of OSINT-related content, from practical guides to conference presentations, highlights the field’s rapid evolution and the need for continuous learning. As organizations recognize the value of OSINT, they are investing in both technology and personnel to harness its potential for proactive defense. However, the same techniques that empower defenders can also be weaponized by adversaries, making awareness and mitigation of OSINT risks a critical component of modern security strategies. Ultimately, the effective use of OSINT can mean the difference between a successful breach and a thwarted attack, emphasizing the need for vigilance and education across all levels of an organization.
Jun 29, 2026
Open Source Intelligence (OSINT) has become a critical tool in modern cybersecurity investigations, enabling organizations to uncover and respond to threats that may otherwise go undetected. In one notable case, a technology firm's CEO began receiving suspicious LinkedIn messages referencing meetings and factory tours that never occurred, raising concerns about impersonation and potential fraud. The investigation, conducted solely with publicly available information, revealed that someone was leveraging the CEO's identity and the company's reputation to deceive partners and clients. This case underscores the value of OSINT in tracing digital breadcrumbs and exposing sophisticated social engineering campaigns. In another scenario, a cybersecurity professional recounted the shock of discovering their company's login portal for sale on a dark web forum, priced at $500 for full access. Despite robust security operations and high detection rates, the breach had gone unnoticed until it was advertised in underground channels. This experience highlighted the importance of correlating OSINT with dark web intelligence to detect early signs of compromise. The professional emphasized that effective threat hunting now requires monitoring both public and clandestine sources, as attackers often leave subtle traces before launching major attacks. By integrating OSINT with dark web monitoring, organizations can identify compromised credentials, data leaks, and emerging threats before they escalate. These real-world examples demonstrate that relying solely on traditional perimeter defenses and alert-based monitoring is insufficient in the current threat landscape. Instead, proactive intelligence gathering from open sources and the dark web can provide early warning and actionable insights. Both cases illustrate how OSINT can reveal hidden attack vectors, support attribution efforts, and inform incident response strategies. The use of OSINT also helps organizations understand the tactics, techniques, and procedures (TTPs) of adversaries, enabling more effective defense measures. Furthermore, these investigations show that even well-defended organizations are vulnerable to sophisticated attacks that exploit social engineering and underground marketplaces. The integration of OSINT into cybersecurity workflows is essential for maintaining situational awareness and reducing the risk of undetected breaches. As threat actors continue to evolve, the ability to correlate information from diverse sources will remain a cornerstone of effective cyber defense. Organizations are encouraged to invest in OSINT capabilities and train their security teams to leverage these resources for both proactive threat hunting and reactive investigations. Ultimately, the strategic use of OSINT can make the difference between a contained incident and a costly, reputation-damaging breach.
Jul 12, 2026