vivek@kali:~/blog$ grep -r "threat-intel" ./posts/

#Threat Hunting

Security research, ethical hacking tutorials, cybercrime case studies, and threat intelligence from the field.

Salt Typhoon APT Analysis 2025: GhostSpider Malware, US Telecom Breach, and Threat Hunting Queries for SOC Teams CVE-2026-5190
Featured · 11 min read
Salt Typhoon APT Analysis 2025: GhostSpider Malware, US Telecom Breach, and Threat Hunting Queries for SOC Teams
Deep technical analysis of the Salt Typhoon APT campaign that breached nine US telecom carriers and accessed CALEA wiretap systems. Covers GhostSpider malware architecture, DEMODEX rootkit, Cisco IOS…
Jul 29, 2026 APT Analysis
CALEA Chinese APT Cisco IOS XE CVE-2023-20198
Read Full Post →
Volt Typhoon Threat Hunting in 2025: KQL, Splunk, and Sigma Detection Guide for Living-Off-the-Land APT CVE-2026-5188
APT Analysis
Volt Typhoon Threat Hunting in 2025: KQL, Splunk, and Sigma Detection Guide for Living-Off-the-Land APT
A complete threat hunting guide for detecting Volt Typhoon living-off-the-land techniques. Includes verified KQL queries for Microsoft Sentinel,…
14 min
Chinese APT CISA advisory critical infrastructure
NightmareEclipse 2026: LegacyHive Windows 0-Day Exposed — Full Attack Chain, MDE Detection Queries & Blue Team Playbook CVE-2026-5158
Blue Team
NightmareEclipse 2026: LegacyHive Windows 0-Day Exposed — Full Attack Chain, MDE Detection Queries & Blue Team Playbook
LegacyHive is an unpatched Windows 0-day (July 2026) targeting the User Profile Service. Full technical analysis of the…
Jul 16, 2026 19 min
Blue Team CVE-2026-50656 Defender Bypass
🔐
CVE-2025-5156
Red Team
HiveNightmare 2025: Why CVE-2021-36934 Still Powers Active Ransomware Campaigns — Complete Red & Blue Team Analysis
CVE-2021-36934 (HiveNightmare) continues powering Hunters International ransomware campaigns in 2025. Full exploitation chain, MITRE mapping, 4 validated Microsoft…
Jul 16, 2025 15 min
Blue Team Credential Dumping CVE-2021-36934