🎯 APT / Espionage theater

Monitors advanced persistent threat groups conducting long-dwell espionage against government, defense, and industry. Focused on intrusion campaigns, tooling, and attribution.

🏹 Threat Actors

🦠 Malware & Tools

🛡 Exploited Vulnerabilities

🧭 Intelligence disciplines

📚 Priority sources & datasets

🔄 Live Datasets & APIs (5 key-free · ingestible)

📜 APT / Espionage Playbook

1. Ingest espionage campaign IOCs and spear-phishing lures from threat-intel vendors and ISAC feeds.
2. Reconstruct the intrusion kill chain from initial access through C2 and exfiltration.
3. Cluster samples by code overlap, C2 conventions, and infrastructure reuse to identify the operating group.
4. Attribute to a named APT by correlating targeting, tradecraft, and toolmarks against MITRE ATT&CK groups.
5. Disseminate a campaign report with YARA and Sigma detection logic and hunting hypotheses.
6. Deploy detections, sweep the estate for prior compromise, and monitor identified infrastructure.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🎯 Add to case

🗃 Data Management

🧩 Advanced Capabilities

🔗 Cross-domain pivots