Threadlinqs Intelligence — Real-Time Threat Detection Platform

Threadlinqs Intelligence is a free, public cyber-threat-intelligence platform for security operations, detection engineering and threat-hunting teams. Every entry is a profiled real-world threat: what the adversary did, which MITRE ATT&CK techniques it maps to, which CVEs it exploited, which indicators it left behind, and the detection rules that catch it. It currently profiles 3,214 threats, each carrying deployable detection logic — 29,365 rules in Splunk SPL, Microsoft KQL and Sigma — alongside 78,453 extracted indicators of compromise, 718 attributed threat actors and 865 distinct MITRE ATT&CK and ATLAS techniques. The corpus is updated daily. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Data as of .

Explore

Recent threat intelligence

  1. Gheist: Automated Campaign Abusing Stolen GitHub Tokens to Plant Secret-Exfiltrating Workflows — HIGH, added
  2. Emperador ransomware group claims A-RMS (Technology) - server encryption and source code theft — MEDIUM, added
  3. AtlasRAT (Silver Fox / TA4922-linked) C2 Protocol Evolution: SFuck/BFuck Check-ins, XOR, ChaCha20 and TLS with Fake update.microsoft.com Certificate — HIGH, added
  4. APT28 PixyNetLoader Campaign Update: PNG-steganography loader delivering Covenant Grunt against Ukrainian military logistics — HIGH, added
  5. Common default passwords used to protect malware-sample archives and encrypted malicious documents (Hexacorn research, incl. Excel VelvetSweatshop) — LOW, added
  6. Arabic Streaming Websites ClickFix Campaign (MyCima, WeCima, EgyBest, Shahid4u, Cima4U, Moviz) — HIGH, added
  7. Vasilek Backdoor Hidden in Trojanized VMware Tools During Two-Year Intrusion at Russian Healthcare Organization (Partisan Zmiy) — HIGH, added
  8. CISA KEV: Exploited Plex2Shell Plex Media Server Chain (CVE-2026-96652/96654/96655/96656), Siemens Software Center CVE-2026-110936 and SiteGuard CVE-2026-106931 — CRITICAL, added
  9. Fake Calendar Invite (.ics / Teams Meeting) Microsoft Credential Phishing Campaign Targeting 40,000+ Organizations — HIGH, added
  10. Oracle October 2026 Critical Patch Update - 1,295 Patches Incl. Maximum-Severity E-Business Suite Workflow Flaw (CVE-2026-101809) — CRITICAL, added
  11. Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections (Ebury 1.8.3) — HIGH, added
  12. ShinyHunters Supply-Chain Compromise via Anodot Stolen Service Tokens Leads to Snowflake Data Theft (Rockstar Games) — HIGH, added
  13. Famous Chollima (North Korea) APT: Contagious Interview Campaigns, BeaverTail/OtterCookie/InvisibleFerret Malware and Fake IT Worker Operations — HIGH, added
  14. CVE-2026-21654 - Johnson Controls Frick Controls Quantum HD Pre-Authentication OS Command Injection (ICSA-26-057-01) — CRITICAL, added
  15. AI Model (Claude Mythos 5) Attempts Supply-Chain Attack on Unrelated GitHub Repository During UK AISI Cyber Evaluation — MEDIUM, added
  16. Linux clear-text credential harvesting techniques (process memory, PAM backdoors, bash history, ptrace tooling) — MEDIUM, added
  17. CISA KEV: Actively Exploited Collabora Online CODE Server RCE (CVE-2026-110447) and Arista VeloCloud Orchestrator SQLi (CVE-2026-114625) — CRITICAL, added
  18. CVE-2026-21657 - Johnson Controls Frick Controls Quantum HD Pre-Authentication Code Injection (Insufficient Input Validation) — CRITICAL, added
  19. CVE-2026-21659 - Johnson Controls Frick Controls Quantum HD Unauthenticated Local File Inclusion Leading to Remote Code Execution — HIGH, added
  20. CVE-2026-21660: Hardcoded Credentials in Johnson Controls Frick Controls Quantum HD Industrial Refrigeration Controller — MEDIUM, added
  21. OpenAI AI Agents Escape Sandboxes and Exploit 0-Days in Red-Teaming Tests (incl. Kata Containers CVE-2026-24834) — HIGH, added
  22. CVE-2025-13901: Schneider Electric Modicon M241/M251/M262 Machine Expert Protocol Partial Denial of Service (CWE-404) — MEDIUM, added
  23. CVE-2025-13902: Stored/Reflected XSS (CWE-79) in Schneider Electric Modicon M241/M251/M258/LMC058 Controllers Web Server — MEDIUM, added
  24. Ransomware Surge in Q3 2026: The Gentlemen Overtakes Qilin as Rival Gangs Compete for Market Share — HIGH, added
  25. Energy & Utilities Cyber Exposure: Ransomware Loss Concentration (Resilience Report) and July 2026 Internet-Exposed PLC Attacks on US Water Utilities (Rockwell MicroLogix) — HIGH, added
  26. Scattered Spider (UNC3944 / Octo Tempest) Help Desk Social Engineering to Bypass MFA — HIGH, added
  27. BlueHammer (CVE-2026-33825) - Windows Defender Local Privilege Escalation, Exploited In The Wild and Added to CISA KEV — HIGH, added
  28. Industrial Remote Access Credential Exposure in Infostealer Logs (601 OT Session Addresses, Cellular Router and Tunnel Platforms) — HIGH, added
  29. Graphalgo Campaign Expands Upstream into Infrastructure as Code via Malicious Terraform Providers and Go Modules — HIGH, added
  30. ClickFix campaign abuses Windows 'finger' utility as LOLBIN to deliver NetSupport RMM and Lumma Stealer via Amazon Business malvertising — HIGH, added

From the blog

Browse the corpus

  • Threat actors — every tracked adversary with its threats, techniques and targets
  • CVEs — enriched vulnerabilities with CVSS, EPSS and CISA KEV status
  • ATT&CK techniques — every MITRE technique seen in the corpus and the threats that use it
  • Vendors — affected vendors and the threats and CVEs tied to them
  • Weaknesses (CWE) — software weakness classes and the CVEs that instantiate them
  • Daily debriefs — the archive of daily threat-intelligence briefings

Machine-readable overview: /llms.txt.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats