Case Files
Intrusion scenarios from KC7 Cyber and Flare Darkroom, worked end to end and written up as finished CTI reports: scope, pivots, timeline, ATT&CK mapping and findings.
Every case is a simulated training environment, not a client incident. “ATT&CK techniques” counts the distinct MITRE ATT&CK techniques mapped in each report.
Dark-web intelligence · 3-part series
From initial access brokers to the ransomware and credential economy, ending in cross-forum correlation and simulated threat-actor engagement.
Public sector / elections · APT campaign
An election-themed APT campaign, tracked through its infrastructure.
Read Part 1 →Energy / ICS · Supply-chain espionage
A supply-chain intrusion into an industrial control systems operator: 470 C2 connections traced across 38 endpoints.
Read the report →Financial services · Insider threat → AD ransomware
An insider-threat case escalating to Active Directory ransomware: 306 endpoints and a 27-day exfiltration window.
Read the report →