Threat intelligence // tracking infrastructure // syscfg.sh
Threatintelligence
Tracking the infrastructure. C2 panels, stealer logs, spyware vendors and the campaigns in flight.
Mapped from primary telemetry - certificate logs, JARM scans, leaked builders - not press releases.
// scanninginfrastructureC2
The track log
what's on file16field reports in this track
114minutes end to end
2024–2026span of events covered
16/16reports with checked sources
Latest in this track
newest firstReal Certificates, Fake Control: Hijacking ccTLD Registries to Mint Trusted TLS Certs for Google
In late September 2026 attackers obtained genuine, browser-trusted TLS certificates for Google domains without…
Open report →FortiBleed: 86,000 Compromised FortiGates, No CVE, and a Number That Keeps Changing Meaning
The FBI and US Secret Service issued a joint advisory on 6 October 2026 about a campaign against internet-facing…
Open report →Nobody Logged In: How ShinyHunters Emptied Hundreds of Salesforce Tenants Through OAuth Grants Nobody Owned
Three times in ten months, ShinyHunters and associated actors took data out of hundreds of Salesforce tenants without…
Open report →The full archive
16 reports // search the stacks16 of 16 reports
01Real Certificates, Fake Control: Hijacking ccTLD Registries to Mint Trusted TLS Certs for Google→02FortiBleed: 86,000 Compromised FortiGates, No CVE, and a Number That Keeps Changing Meaning→03Nobody Logged In: How ShinyHunters Emptied Hundreds of Salesforce Tenants Through OAuth Grants Nobody Owned→04FinFisher, Hacking Team, Pegasus: Inside the Commercial Spyware Industry That Sells Surveillance to Governments→05NSO Group and Pegasus: The Mercenary Spyware Industry and the Journalists Who Were Killed Because of It→06Volt Typhoon: China's Pre-Positioned Access to US Critical Infrastructure→07Salt Typhoon: How China Breached US Telecom Carriers and Accessed the Wiretap Infrastructure→08The Snowden Disclosures: How One NSA Contractor Revealed the Architecture of Global Surveillance→09The Axios npm Compromise: A Phantom Dependency and a Cross-Platform RAT→10Meduza Stealer: Mapping 140+ Active C2 Panels via Certificate Transparency→11Tracing Ransomware Infrastructure: Two Real Cases→12JARM: What It Actually Fingerprints, and What It Misses→13The NSA's ANT Catalog: A Product Brochure for Backdoors in Everything→14The Credential Stuffing Economy: Combolists, Stealer Logs, and the Infrastructure of Account Takeover→15The Internet Research Agency: How Russia's St. Petersburg Troll Farm Actually Worked→16Emotet, TrickBot, Ryuk: The Three-Stage Ransomware Chain That Devastated Healthcare→
Track console
shell // guest sessionguest@SYSCFG-THREATINTE--:--:--
track online // 16 reports indexed
type help, or random.
Try help, random, latest, grep <term>, or count.