Over 7 a month period, a Qilin affiliate exposed 5 C2 servers -> OPSEC L -> Sliver C2 / SOCKS running on WatchGuard devices -> Initial access primarily via WG/Fortinet exploitation -> 3 real victims found via Qilin blog -> 🇺🇸 & 🇩🇪 targeting -> 7 CVEs used Link to blog below👇

@jabarprovgoid Your network has been compromised by a threat actor. Please contact myself or @ctrlaltintel and we will help you resolve this intrusion free of charge. Compromised hostname: crm They have persistence and root

Incredible reporting on logistics sector targeting (likely linked to cargo theft gangs) @beensquatted haveibeensquatted.com/blog/t… http://23[.]94[.]252[.]241/share/new_agreement_timo_MAY27.exe 3 RMMs deployed from the initial dropper 🤯

🚨 Workshop Spotlight # 14 👉 "Offensive Threat Intel: Tracking & Disrupting Adversaries for Fun" by Josh Allman (@xorJosh) & Ben Folland (@polygonben), of CtrlAltIntel 📝 Description You don't need access to private telemetry or a job at a major security firm to hunt down threat actors in the wild and impose costs. Josh and Ben are proof. A couple of friends having fun built CtrlAltIntel and ended up making an impact on a global scale, supporting governments, military organizations, law enforcement, and more, all from analyzing public data. This workshop walks through how they did it, and how you can too. You'll learn their methodology for tracking adversaries using platforms like Hunt.io, Censys, and Shodan, complete with specific queries and real-world examples. Then, get in the driver's seat: - In The Hunt, you'll practice querying and pivoting from a single data point to identify and report active threat actor infrastructure. - In Mining Gold from Open Directories, you'll work with safe data from their previous hunts and run your own analysis. Their goal is simple: inspire you to give this a go and start taking down cybercriminals yourself. 🎟️ Only at ContinuumCon 2026 Work through it live, or revisit the lab on your own time. Own it forever. The workshop doesn't end when the conference does. Got your ticket yet? 👉 continuumcon.com/ Hosted by @_JohnHammond , @JustHackingHQ , @AnthonyBendas , and @Level_Effect !

RT @BushidoToken: Please look into this @virginmedia you’re blocking legitimate security researchers:

@AWEGroupe Your network has been compromised by a threat actor. Please contact myself or @ctrlaltintel and we will help you get rid of their malware (completely free of charge, of course). Compromised machine hostname: cineyglpi Malware process name: [mm_percpu_wq]

👀😬