All threat intelligence reports

The single-indicator pivot dies against a tier-separated operator, stopping at the access surface. This doctrine proposes five moves for reading metadata after: seed a behavioral cohort, mine persistent fingerprints, separate attack signature from residue, judge on surrounding context, converge by independent method.

We fed 95 EvilTokens campaign IPs into ClusterHawk and mapped a four-tier architecture. It spans a Cloudflare CDN frontend, DocuSign/Exim backend hosting, a bridge cluster on Google Trust Services certs, Cobalt Strike C2 fronted through the CDN, and an unreported IoT layer of Hikvision/Dahua cameras.

Over 1,500 IPs from Shodan's exposed Ollama index were analyzed through ClusterHawk. After filtering 60% honeypots, 13 of 27 clusters pointed to one operator, XRUI TECHNOLOGY LIMITED, running identical nginx/MySQL/Ollama stacks with unauthenticated qwen3-vl inference across 35+ hosts.

We received 50 validated IPs linked to a suspected Russian state-sponsored APT, profiled them through ClusterHawk, and extracted a common fingerprint. Pivoting that profile against internet scanning data surfaced about 1,900 matching assets across 15 countries. We call this tracking effort OVERCAST.

Analyzing 1,602 internet-visible Modbus systems turned up systematic patterns, not scattered misconfigurations. Ninety-five percent share TLS fingerprints, identical certificates, and the same CVEs across clusters, and the entire ICS ecosystem deploys infrastructure in predictable, exploitable ways.

Through infrastructure clustering analysis, we identified a proxy network of 832 compromised KeeneticOS routers operating across Russian ISPs. The investigation shows how consumer routers get turned into weaponized infrastructure for threat actors.

We confirm Trellix's reporting on SideWinder's PDF ClickOnce chain and targets. Testing the method, we pivoted on VirusTotal-communicated IPs and separated CDN/search noise (about 85%) from a compact nginx micro-cluster (about 15%), then built ready-to-run SIEM/Sigma and Shodan/Censys hunts.

We seeded ClusterHawk with eSentire's published NetSupport indicators and clustered the infrastructure behind ClickFix delivery. The results validate against eSentire TRU's reporting and IoCs, and add a predictive WinRM signature plus anomaly-led IP triage.

Over 2,700 malicious IP addresses were analyzed in an explorative clustering experiment using ClusterHawk to group adversarial infrastructure. The objective: determine whether Command-and-Control (C2) servers cluster by operational similarity alone, without relying on predefined family signatures.

We independently validated and extended Lumen's SystemBC findings with Chawkr's clustering pipeline. The result: role-based infrastructure profiles, stability metrics, and anomaly scores.

This guide teaches analysts how to read platform-generated reports, what to focus on, and how to validate claims against the underlying artifacts.

Threat actor profiles are data-driven portraits of an adversary's persistent behaviors, not single indicators like IPs or hashes. They track infrastructure choices, operational cadence, cryptographic habits, naming schemes, and product stacks.