.webp&w=828&q=75)
Criminal IP releases Splunk TI Feed app for firewall correlation
The Splunkbase app refreshes Criminal IP data every three hours and correlates it with firewall logs every 10 minutes.
Stories per day · 30 days
12 RSS
Relatedsoc14sandbox12any-run6any.run6recorded-future5criminal-ip4ioc4malware-analysis4mandiant4mssp4socradar4siem3splunk3agentic-ai2attack-surface2crowdstrike2cryptocurrency2cti2
171 stories, newest first · one card per story
Stories tagged #threat-intelligence
SOCRadar promotes an MCP server and a new MSSP MCP server
The captured page is mostly site navigation, so the 126-tool claim is not described in the body.
SOCRadar page titles an October 2026 attack roundup
The captured page is site navigation and product marketing, not a write-up of the named incidents.
US MSSP adds ANY.RUN threat feeds to SIEM to cut manual triage
The unnamed provider says five analysts gained 25% more capacity after sandbox and IOC feed integration.
Threat Intelligence Feeds Often Miss Emerging Threats
SOCRadar and ANY.RUN discuss how additional threat intelligence feeds may not close gaps in detecting new threats.
SOC leaders should prioritize threat intelligence integration
ANY.RUN integrates threat intelligence into security workflows to enable earlier detection and reduce investigation bottlenecks.
1
AI-generated malware shows uniform code patterns and emojis
Threat intelligence expert notes AI-generated malware includes function comments and emojis, speeding fraud campaigns.
ANY.RUN Adds Related Threat Context and Malware Detections
ANY.RUN's October release introduces Related Threat Context in the Interactive Sandbox and expands coverage with 591 new signatures.
Check Point weekly bulletin covers crypto thefts and exploited flaws
The November 2 roundup also cites a claimed $6.3 billion Binance theft and exposure of about 4.9 million student-aid records.
4
ANY.RUN Recaps it-sa 2026: Trends in Security Operations
ANY.RUN showcased malware analysis tools and threat intelligence at it-sa 2026 to help SOC teams reduce triage time and improve incident response.
1
Intel471 says Italy draws an unusual, outsized attack mix
The firm shared a pre-publication report with Dark Reading and offers three theories, which the excerpt does not include.
1
2026 ranking puts Recorded Future first among CTI providers
Mandiant and CrowdStrike place second and third; Kaspersky is flagged as jurisdiction-gated for Western buyers.
4
North Korean actors use AI to scale social engineering and malware
Microsoft rates Jade Sleet, Coral Sleet, and Jasper Sleet as operationalized; operations remain human-directed, not autonomous.
2
2026 buyer's guide ranks 12 cyber threat intelligence feeds
The unpaid comparison maps each provider to the question it answers best and flags Kaspersky for US and allied procurement bans.
1
2026 guide compares 12 threat intelligence platforms
The unpaid review judges platforms on operationalization and flags Mastercard and Securonix ownership as RFP questions.
1
2026 ranking puts Recorded Future first among threat intelligence platforms
Editorial scores, not lab tests, place Anomali second and open-source OpenCTI third.
2
ARBITRA maps full CTI reports to ATT&CK with expert argumentation
Specialized LLM experts propose entities from whole reports, then a quantitative argumentation check filters them against document evidence.
ANY.RUN pitches related threat context for faster SOC triage
The vendor says related analyses draw on 16,000-plus SOC teams and a community of more than 700,000 professionals.
ANY.RUN promotes AI sandbox features for SOC phishing analysis
A vendor demo follows an Adobe PDF link into a Microsoft OAuth phish and shows 70-plus related analyses.
SOCRadar post titles n0n an AI-assisted extortion operation
The captured page is site navigation only, so tactics, victims, and confirmation of attacks are not in the text.
Criminal IP joins INTERPOL Gateway to share cyber threat data
AI SPERA will contribute IP, domain and exposed-asset intelligence that INTERPOL may turn into leads for member countries.
1
ANY.RUN says a third of sandbox IOCs were already in its feeds
The vendor says SIEM, SOAR, TIP, EDR and XDR integrations can match those indicators before a manual investigation.
1
SOCRadar roundup page titled September 2026 attacks has no incident text
The captured page is site navigation and product marketing, not a report of the FBI, Clop, or IDScan events.
1
Australia’s ASD issued more than 4,400 cyber warnings in a year
Victim reports helped disrupt an August 2025 Akira campaign linked to a known SonicWall flaw.
1