ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “osint”

441 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllRansomware 70Vulnerability 70Malware 60Phishing & fraud 49Threat actor 45Data breach 44Industry 40Exploit / PoC 27Policy & legal 22Tools 4AI safety & security 4Research 3AI research 1Model release 1
SeverityAllcritical 123high 136medium 101low 70info 11

Introducing Unit 42’s Attribution Framework

Unit 42 releases its Attribution Framework, a systematic method using Diamond Model and Admiralty scores to attribute activity clusters to named threat actors.

Palo Alto Networks' Unit 42 introduced a structured framework for threat actor attribution built on the Diamond Model of Intrusion Analysis and Admiralty reliability/credibility scoring. The framework tracks activity at three levels: activity clusters (named CL-STA, CL-CRI, CL-UNK, or CL-MIX), temporary threat groups, and named threat actors using the constellation naming schema. Analysts score evidence across TTPs, tooling, malware code, OPSEC, infrastructure, timelines, and victimology to decide when to merge or elevate clusters, avoiding premature group naming.

Palo Alto Unit 42 · Aug 17, 2026Research

Strategic Threat Intelligence for Better Decision-Making

Recorded Future outlines strategic threat intelligence: non-technical, OSINT-driven analysis for board-level decisions and the skill sets needed to produce it.

Recorded Future's blog post explains that threat intelligence spans strategic, tactical, operational, and technical categories, focusing on strategic intelligence. It defines strategic intelligence as non-technical, risk-based analysis produced mainly from OSINT sources on demand for C-suite and board audiences. The piece stresses the sociopolitical and business expertise required and urges boards to ask trend-focused questions rather than demanding specific attack predictions.

Recorded Future · Aug 17, 2026Industry

Tactical Threat Intelligence Explained: Benefits & Use Cases

Recorded Future explains tactical threat intelligence, covering attacker TTPs, IOC collection, and use in SOC detection, response, and control hardening.

Recorded Future published an explainer on tactical cyber threat intelligence, describing how it differs from strategic and operational intelligence by focusing on attacker tactics, techniques, and procedures. The piece outlines sources such as OSINT, dark web monitoring, malware analysis, and internal telemetry, and describes the intelligence lifecycle from collection through dissemination. It argues tactical CTI improves detection tuning, incident response, preventive controls, and resource allocation for SOC teams.

Recorded Future · Aug 17, 2026Industry

12 Best Browser Isolation Solutions Compared (2026): Features & Pricing

2026 comparison ranks Zscaler, Cloudflare, Menlo Security, Garrison (Everfox), Authentic8 and Kasm among twelve remote browser isolation solutions.

Guide compares twelve RBI products across four architectures: pixel streaming, DOM/vector reconstruction, platform-embedded SSE isolation, and self-hosted containers. Zscaler and Cloudflare lead RBI delivered inside SSE platforms, while Menlo Security leads isolate-everything efficacy and Garrison (Everfox) provides hardware-grade isolation for government use. Most offerings price per user per month.

GBHackers · 1d agoTools

Top 10 Best Browser Isolation Solutions in 2026

A 2026 market overview ranks ten remote browser isolation tools, with Menlo Security as the pure-play reference as SSE vendors bundle isolation.

The article compares ten remote browser isolation (RBI) options, including Menlo Security, Zscaler, Cloudflare, Palo Alto Networks, Broadcom (Symantec), Forcepoint, Skyhigh Security, Ericom (Cradlepoint), Authentic8, and Garrison. It argues that RBI has become a bundled policy action inside SSE platforms from Zscaler, Cloudflare, Palo Alto, Broadcom, Forcepoint, and Skyhigh, compressing standalone pricing and driving consolidation such as Ericom's isolation moving under Cradlepoint (Ericsson). Enterprise browsers like Island and Chrome Enterprise Premium are reshaping the RBI-versus-browser decision for managed users, while selective policy-driven isolation of risky categories is described as the prevailing 2026 architecture. The piece is a buyer's guide with vendor positioning, not an incident or vulnerability report.

Cyber Security News · 5d agoIndustry

Inside Knight Office, a New M365 AiTM Phishing Kit

Huntress details Knight Office, a new AiTM phishing kit stealing Microsoft 365 session tokens and registering attacker-controlled devices.

Huntress investigated an August 18, 2026 adversary-in-the-middle attack using the Knight Office phishing kit, which captured Microsoft 365 session tokens via a DocuSign-style lure routed through a Monday.com tracking link and a compromised Joomla site. After token capture, the actor enrolled an unauthorized host in Microsoft Entra ID and bound a Windows Hello for Business key credential to the account. The kit's operator console, found at IP 104.37.188.94, is built on Python Flask and hosts at least 25 .vu phishing domains. Telemetry links the kit to at least nine token-replay logins in two weeks and roughly 700 reported lure emails since April.

Huntress · 14d agoPhishing & fraud in the wild1