The post Convert XLS To CSV appeared first on AddictiveTips.

Written by: Jules Czarniak

The post UK charges five persons linked to fraud platform behind more than a million scam calls appeared first on Help Net Security.

SUMMARY

The presenter outlines a practical cybersecurity workflow, covering ergonomic setups, browser isolation, virtual machine troubleshooting, AI-assisted scripting, and network tunneling methods utilized during active security assessments.

ONE-SENTENCE TAKEAWAY

Isolate browser environments, utilize automation scripts, and verify network paths before starting security tests to avoid workflow interruptions.

TOOLS

• Talon Voice – Open-source voice recognition software enabling hands-free computer control and command execution.
• Obsidian – Local-first markdown note-taking application supporting secure, AI-friendly knowledge management.
• AutoHotkey – Windows scripting utility for creating custom macros and remapping keyboard inputs.
• Chrome Debug Commands – Browser developer tools allowing direct inspection of extensions, cookies, and storage.
• Whisper Diarization – Audio processing script that separates speaker tracks and converts recordings to searchable text.
• Hyper-V / WSL – Microsoft virtualization platforms enabling isolated guest environments and Linux subsystem integration.
• OpenConnect / OpenVPN – Command-line tunneling clients used for establishing secure, split-tunnel network connections.
• Jamboree Framework – Portable PowerShell environment that dynamically provisions development tools without altering system paths.
• MOBA Portable – Feature-rich terminal emulator supporting static/dynamic tunnels, auto-reconnect, and embedded X-server capabilities.
• Nmap – Network discovery and security auditing tool utilized for comprehensive port scanning and service detection.

00:00:00 Ergonomic Workspace Configuration

Configures physical workstation elements to reduce strain during extended testing sessions. Proper alignment prevents repetitive stress injuries while maintaining focus on technical tasks.

• Monitor Positioning – Displays should align with eye level to maintain neutral neck posture; the speaker notes their curved 49-inch screen sits slightly high due to chair adjustments.
• Split Keyboard Layout – Utilizes a Freestyle 2 mechanical keyboard, allowing natural shoulder-width arm placement and reducing wrist deviation during prolonged typing.
• Postural Adaptation – Acknowledges that ergonomic equipment requires matching body alignment; elbow rests should sit between hip and shoulder height for optimal leverage.

01:45:00 Voice Control & Note Synchronization

Utilizes auditory input methods and localized knowledge bases to streamline documentation workflows. Separating secure work notes from casual observations prevents data contamination.

• Talon Voice Integration – Runs continuously to handle navigation, text entry, and application switching without manual keyboard interaction.
• Obsidian Migration – Transitions from cloud-based keep apps to local markdown files, enabling direct querying by local AI models while maintaining offline accessibility.
• Note Categorization – Divides information into secure work records and insecure personal logs, ensuring clean data pipelines for future retrieval and analysis.

03:50:00 Browser Extension Management & Security Isolation

Separates web browsing activities from primary work processes to minimize attack surfaces. Running dedicated user profiles prevents plugin conflicts and credential leakage.

• Jailed User Accounts – Creates restricted system profiles that only launch the browser, isolating extensions from core workstation operations.
• Shared Folder Synchronization – Establishes a single directory path bridging work and browsing users, allowing seamless file transfers without cross-contamination.
• Extension Audit Process – Leverages Chrome debug commands to enumerate installed plugins, verifying functionality before deployment on target networks.

06:15:00 Training Optimization & Audio Processing

Accelerates mandatory compliance viewing through speed manipulation and automated transcription. Converting video content into searchable text enables rapid information retrieval.

• Global Speed Control – Increases playback rates up to sixteen times normal speed, drastically reducing time spent on repetitive corporate training modules.
• Whisper Diarization Pipeline – Downloads video tracks, separates speaker voices, and generates timestamped transcripts for quick reference during assessments.
• Download Management – Employs multi-threaded swarm downloaders and classic turbo managers to handle bulk media retrieval without interrupting active workflows.

10:40:00 Virtualization & Network Tunneling Protocols

Establishes isolated testing environments using Windows virtual machines while managing connectivity constraints. Proper session handling prevents unexpected disconnections during remote engagements.

• Enhanced Session Mode – A Hyper-V feature providing higher resolution and shared clipboard functionality; disabling it is required before initiating certain VPN clients to avoid routing conflicts.
• Split Tunneling Mechanics – Routes specific traffic through the virtual network while keeping local resources accessible, preventing complete internet loss during connection tests.
• Certificate Verification – Identifies self-signed SSL mismatches early in the process, documenting them as preliminary findings before proceeding with authentication steps.

15:30:00 Macro Automation & Input Remapping

Remaps frequently used keyboard shortcuts to reduce physical strain and accelerate command execution. Running scripts with elevated privileges ensures reliable input registration across virtual environments.

• Caps Lock Repurposing – Converts the caps lock key into a primary modifier, assigning copy/paste functions to adjacent letters for faster workflow navigation.
• Physical Typing Macros – Simulates keystrokes with deliberate delays, allowing seamless data entry into restricted VM consoles that block standard clipboard operations.
• Administrator Execution Requirement – Highlights that macro scripts must run with elevated privileges to successfully inject inputs across different desktop sessions.

20:15:00 Portable Development Environments & Python Management

Deploys lightweight scripting frameworks that dynamically provision necessary tools without modifying host configurations. Verifying package contents prevents dependency conflicts during testing.

• Jamboree Framework – A PowerShell-driven utility that downloads and configures development stacks on demand, resetting environment variables to maintain system cleanliness.
• NuGet Package Filtering – Queries Microsoft's repository API to retrieve specific Python versions, ensuring compatibility with legacy tunneling scripts.
• Binary Verification Process – Checks extracted archives for bundled pip.exe or pip3.exe executables, eliminating manual module installation steps during rapid deployments.

28:40:00 AI-Assisted Scripting & Debugging Workflows

Generates and refines PowerShell functions through iterative conversational prompts. Validating AI output against actual system behavior prevents silent configuration errors.

• Vibe Coding Approach – Relies on continuous feedback loops with language models to draft, minimize, and debug automation scripts in real-time.
• Parameter Standardization – Enforces strict formatting rules for PowerShell commands, avoiding hardcoded paths and ensuring cross-environment compatibility.
• Temporary Storage Management – Monitors extraction directories to prevent disk saturation, redirecting large package downloads away from constrained system partitions.

35:10:00 Terminal Emulation & Advanced Tunneling Strategies

Facilitates complex network routing through dedicated terminal applications. Configuring dynamic and static tunnels enables reliable reverse connections for remote assessments.

• MOBA Portable Configuration – Utilizes an INI-based tunnel manager that automatically maintains connections across changing IP addresses or Wi-Fi networks.
• Reverse Shell Routing – Establishes outbound channels back to the tester, then proxies all subsequent traffic through those connections for consistent monitoring.
• Proxy Chain Integration – Forces non-proxy-aware applications to route through Burp Suite or custom interceptors using Windows utility wrappers like Priboxy.

42:30:00 Final Connectivity Testing & Engagement Wrap-Up

Executes comprehensive port scans to verify target accessibility before documenting findings. Acknowledging workflow detours ensures realistic time management during active engagements.

• Nmap Verification – Runs full-port scans with verbose output to confirm host responsiveness and identify open services prior to credential testing.
• Connection Refusal Documentation – Captures screenshot evidence of failed routing attempts, providing clear proof of network restrictions for client reporting.
• Workflow Reflection – Recognizes that exploratory debugging adds value but requires time boundaries; balancing thoroughness with engagement scope maintains professional efficiency.

Provide feedback on this episode.

Read more of this story at Slashdot.

The post Datalab Lift vs the Field: How a 9B Schema-First Extractor Compares with NuExtract3, LlamaExtract, Marker, and Docling appeared first on MarkTechPost.

We’re now expanding support to French, German, Italian, Japanese, Korean, Portuguese, and Spanish. 

Getting started

• Admins: There is no admin control for this feature.
• End users: There is no end user setting for this feature. Visit the Help Center to learn more about converting Google Slides into Google Vids.

Rollout pace

• Rapid Release domains: Gradual rollout (up to 15 days for feature visibility) started on June 30, 2026
• Scheduled Release domains: Full rollout (1–3 days for feature visibility) starting on July 20, 2026

Availability

• Business: Business Starter, Standard, and Plus
• Enterprise: Enterprise Starter, Standard, and Plus
• Education: Education Plus
• Consumer: Google AI Pro and Ultra
• Other Editions: Enterprise Essentials and Enterprise Essentials Plus; Nonprofits
• Education Add-ons: Google AI Pro for Education; Teaching and Learning
• Other Add-ons: AI Expanded Access

Resources

• Google Help: Convert Google Slides into Google Vids

Read more of this story at Slashdot.

Introduction

AdversaryGraph started as a practical question:

How can a security team move from threat intelligence to detection engineering without losing the evidence trail?

Most CTI workflows produce useful text, but the next steps are often manual. An analyst reads a report, extracts behaviors, maps them to MITRE ATT&CK, compares them with known actors, enriches IOCs, writes detection ideas, and then asks a detection engineer to validate whether telemetry actually exists in the SIEM.

That gap is where a lot of defensive work slows down.

AdversaryGraph v5.0 is my attempt to make that workflow more operational. It is not only a CTI visualization project. It is a self-hosted analyst workbench that connects:

• Report and telemetry analysis.
• ATT&CK technique mapping.
• Group, campaign, and report similarity.
• IOC enrichment and investigation.
• Malware analysis workflows.
• Asset attack-surface mapping.
• Attack simulation.
• SIEM forwarding and validation.
• Analyst-ready documentation and reports.

The main addition in release 5.0 is Attack Simulation: a controlled ATT&CK validation workspace where an analyst can select a technique, run approved lab scenarios, inspect target-side telemetry, forward logs to a SIEM collector, and use an AI assistant to generate coherent multi-phase attack-chain drills.

This article explains what is new in v5.0, how the architecture works, what the platform can do today, and how I expect analysts and detection engineers to use it.

Project links:

• Project landing page: https://1200km.com/adversarygraph/
• Documentation: https://1200km.com/adversarygraph-docs/
• GitHub: https://github.com/anpa1200/adversarygraph
• Release v5.0.0: https://github.com/anpa1200/adversarygraph/releases/tag/v5.0.0

Table of Contents

• Getting Started
• The Problem: CTI Often Stops Before Validation
• What AdversaryGraph Is
• Core Capabilities Before v5.0
• What Is New in v5.0
• TTP-First Simulation Workflow
• Real Lab Telemetry for Web Scenarios
• SIEM Forwarding
• AI Attack Assistant
• Coherent Kill Chains, Not Random Events
• Explain Attack
• Named Scenario Library
• Safety Boundaries
• How This Fits Detection Engineering
• Architecture Overview
• Example Use Case: Password Spray Detection
• Example Use Case: Web Recon to Exploit-Shaped Telemetry
• Example Use Case: Malware Findings to Detection Validation
• Example Use Case: Asset Inventory to Attack Surface
• What This Release Is Not
• What Makes v5.0 Different
• Getting Started
• Final Thoughts

The Problem: CTI Often Stops Before Validation

A typical CTI-to-detection workflow looks like this:

1. Read an external report, internal incident report, malware note, or intelligence summary.
2. Extract behaviors: PowerShell, scheduled tasks, credential dumping, public-facing application exploitation, exfiltration, persistence, discovery, and so on.
3. Map those behaviors to MITRE ATT&CK.
4. Compare them with known actor and campaign profiles.
5. Identify relevant IOCs.
6. Write hunting hypotheses and detection logic.
7. Ask whether the SIEM actually receives the required telemetry.
8. Test rules with sample logs, lab traffic, or purple-team activity.

The hard part is not just mapping. The hard part is preserving the chain from evidence to technique to telemetry to detection validation.

If the SIEM parser is broken, the detection will not fire.

If the event structure is wrong, the rule will not match.

If the test event is too synthetic, the validation result is misleading.

If the ATT&CK mapping is not tied back to evidence, the report becomes hard to defend.

AdversaryGraph v5.0 focuses on this full chain.

What AdversaryGraph Is

AdversaryGraph is a self-hosted CTI-to-detection platform. It combines a public research interface with a Docker-based private platform.

The public site is useful for exploration: ATT&CK matrix navigation, group research, public technique context, and project documentation.

The self-hosted platform is where private work belongs: AI-assisted report analysis, stored investigations, IOC enrichment, malware-analysis workflows, asset inventories, attack simulation, SIEM validation, and API-driven workflows.

The high-level workflow is:

1. Ingest reports, logs, IOCs, malware findings, asset inventory, or feed data.
2. Map behaviors to ATT&CK with evidence and confidence.
3. Enrich IOCs, actors, campaigns, malware families, and references.
4. Validate coverage using lab telemetry and SIEM forwarding.
5. Report findings in analyst-ready form.

Core Capabilities Before v5.0

Release 5.0 builds on a broader platform. The major existing modules are still part of the release and matter because Attack Simulation is designed to connect to them.

All capabilities here:

Platform Capabilities | AdversaryGraph Documentation - CTI-to-Detection Workbench | 1200km

AI-Assisted ATT&CK Mapping

Analysts can paste text or upload reports and ask the configured LLM provider to extract ATT&CK candidates. The platform supports multiple provider options, including Claude, OpenAI, Gemini, MiniMax, and local OpenAI-compatible gateways.

The important part is not simply “ask AI for TTPs.” The useful part is that mappings are treated as analyst-assistance data:

• Techniques are shown with evidence.
• Confidence is visible.
• Output can be reviewed before operational use.
• Extracted TTPs can be pushed into the Navigator.
• Results can be compared with groups, campaigns, and stored reports.

ATT&CK Navigator and Group Context

The Navigator is the central workspace for technique review. It supports Enterprise, Mobile, ICS, and ATLAS-style workflows. Analysts can search techniques, build layers, overlay group context, import/export layers, and move selected TTPs into comparison and reporting workflows.

This matters because many teams already think in ATT&CK, but their toolchain is split between reports, spreadsheets, diagrams, SIEM rules, and ticketing systems. AdversaryGraph tries to keep the matrix connected to the rest of the investigation.

Group, Campaign, and Report Similarity

AdversaryGraph uses TTP overlap as a way to generate hypotheses. It compares selected behavior against ingested group profiles, campaigns, and stored report libraries.

This is intentionally framed as similarity, not attribution.

TTP overlap can help prioritize research. It can suggest which actor profiles or campaigns deserve review. It is not proof that a specific actor is responsible for an intrusion.

IOC Investigation

The IOC workflow lets analysts pivot from observable data into reputation and relationship context. IPs, domains, URLs, hashes, and other observables can be investigated with feed context and ATT&CK leads.

Malware Analysis

The Malware Analysis module connects static triage, hash checks, unpacking, strings, decompilation/debug views, runtime-gated analysis, and AI summaries back to the CTI workflow.

The point is not to replace a reverse engineer. The point is to help analysts preserve malware-derived evidence and map it into ATT&CK, IOCs, and investigation outputs.

Asset Attack-Surface Mapping

AdversaryGraph can ingest asset inventory input, normalize assets, score exposure, propose likely entry points, and map asset-driven ATT&CK candidates.

This is useful when the question is not “what did the attacker do?” but “what could an attacker realistically try against my exposed environment?”

Examples:

• Public web applications.
• VPN and identity services.
• Exposed admin panels.
• Cloud assets.
• Remote management services.
• High-value internal systems.
• Scanner and CMDB exports.

What Is New in v5.0

The headline feature is Attack Simulation.

Attack Simulation is designed for defensive validation and detection engineering. It lets analysts work from a TTP-first interface, run safe simulations, inspect telemetry, and forward events to a SIEM.

This is not an exploitation framework. It does not run malware. It does not execute arbitrary commands against arbitrary user targets. It is a controlled validation workspace for authorized lab scenarios and source-shaped telemetry drills.

The v5.0 release adds:

• A new Attack Simulation workspace.
• ATT&CK-style matrix selection for runnable simulations.
• Dedicated configuration pages per selected TTP.
• Built-in lab web target for web-focused scenarios.
• Target-side real-time log viewing.
• SIEM forwarding to HTTP(S) collectors.
• Saved recent SIEM destinations.
• AI Attack Assistant.
• “Challenge Me” mode.
• Complicated multi-source attack-chain scenarios.
• 25 named coherent scenario templates.
• Attack-chain graph.
• Explain Attack panel.
• Source-shaped Windows, Sysmon, EDR, DNS, proxy, firewall, web, and WAF event generation for SIEM parser and rule validation.

TTP-First Simulation Workflow

The workflow starts with the ATT&CK matrix.

Runnable simulation cells are visible directly in the matrix, and related TTP pages can link back into the simulation workflow. This keeps the analyst oriented around ATT&CK instead of hiding simulations behind unrelated forms.

The basic flow is:

1. Open Attack Simulation.
2. Choose a TTP from the matrix.
3. Open the dedicated simulation page.
4. Review what the scenario does.
5. Review telemetry source and event structure.
6. Run the lab scenario or AI-assisted telemetry drill.
7. Inspect logs in real time.
8. Forward selected logs to the SIEM.
9. Confirm whether detections fired.
10. Record validation gaps.

Each scenario explains:

• What happens.
• What adversary behavior is represented.
• Which system emits telemetry.
• Which event structures are expected.
• What the detection should focus on.
• Which telemetry is production-like and which is a lab canary.
• What the validation gaps are.

That explanation is important. A simulation without context is just noise. A simulation with context becomes a detection-engineering exercise.

Real Lab Telemetry for Web Scenarios

One major design goal was to avoid fake “log generation” for web scenarios where a real lab target can safely produce logs.

For web-focused simulations, the Docker deployment includes an attack-lab-web target. The AdversaryGraph API sends real HTTP requests to that lab web server over the Docker network. The target server writes its own logs.

The analyst can then inspect real target-side telemetry such as:

• NGINX access logs.
• NGINX error logs.
• Application authentication logs.
• WAF/security-style logs.
• Structured web JSONL telemetry.
• Run-specific JSONL logs.
• Merged attacked-server events.

This is different from simply printing a row that looks like an access log. The request is sent to the lab server, and the server emits the log.

Supported web-focused scenarios include:

• HTTP and TLS service fingerprinting.
• Public application probing.
• Path discovery.
• Sensitive file and configuration path access.
• Directory traversal canaries.
• SQL injection-shaped requests.
• XSS-shaped requests.
• SSRF-shaped requests.
• Command-injection-shaped requests.
• Web-shell access canaries.
• Upload and download scenarios.
• Failed-login flows.
• Brute-force patterns.
• Password spray.
• User enumeration.
• Beacon-like web traffic.
• Exfiltration-shaped traffic.

The key phrase is “attack-shaped canary.” The goal is to generate realistic defensive telemetry without exploiting a real target or executing harmful payloads.

SIEM Forwarding

Validation is incomplete if the event never reaches the SIEM.

The v5.0 SIEM forwarding panel sends selected Attack Simulation telemetry to HTTP(S) collectors. This can be used with Logstash HTTP input, Splunk HEC-style collectors, XpoLog/Logeye listeners, or custom webhook receivers.

Supported controls include:

• Full URL or raw host:port/path destination.
• Direct destination mode.
• Docker host gateway routing.
• Automatic route selection.
• Raw original line per request.
• JSON event per request.
• JSON Lines.
• Batch envelope.
• No auth.
• Bearer token auth.
• Token auth.
• Basic auth.
• Custom token header.
• Source selection: access, auth, endpoint, WAF/security, error, structured JSONL, run JSONL, or all attacked-server events.

The platform also keeps the last 10 non-secret SIEM destinations for reuse. This is useful during repeated parser testing, rule tuning, and dashboard validation.

Credentials are not stored as part of the saved destination history. The saved address is intended to reduce typing friction, not to become a secret store.

AI Attack Assistant

The AI Attack Assistant is one of the main additions in v5.0.

It helps generate detection-engineering drills by building correlated telemetry stories around selected behavior.

The assistant supports three modes:

1. Selected TTP: generate a focused validation flow around the technique currently selected in the Attack Simulation page.
2. Threat actor: generate a scenario inspired by a threat actor’s known behavior and ATT&CK profile.
3. Challenge Me: generate a blind multi-phase detection challenge for the analyst.

There is also a Complicated attack option. When enabled, the assistant builds longer multi-source flows across telemetry types such as:

• Windows Security Event Log.
• Sysmon.
• EDR process and file telemetry.
• DNS logs.
• Proxy logs.
• Firewall traffic logs.
• Web access logs.
• WAF/security logs.
• Authentication logs.

The goal is not to normalize everything into one generic schema. For complicated scenarios, the assistant should preserve source/vendor-shaped event patterns so the SIEM parser and rule logic are tested more realistically.

Coherent Kill Chains, Not Random Events

A detection drill should not be a random list of suspicious events.

In v5.0, complicated scenarios are built as coherent attack chains. The chain has ordered phases, each phase has a reason, and each phase emits events that should correlate with the surrounding activity.

For example, a password-spray-to-foothold scenario may include:

1. Username enumeration.
2. Multiple failed authentication attempts.
3. One successful logon after failures.
4. Endpoint discovery from the authenticated host.
5. Suspicious tool transfer.
6. Persistence or lateral discovery.

That is much more useful than a single failed-login event.

The Attack Chain Graph makes this visible.

Each phase can show:

• Phase number.
• ATT&CK technique.
• Telemetry source.
• Event format.
• Event count.
• Detection goal.
• Supporting tags.

This helps the analyst understand whether the generated activity is a plausible kill chain or just a bag of indicators.

Explain Attack

When “Challenge Me” or a complex AI-generated scenario is used, the platform includes an Explain Attack action.

This panel explains:

• What the scenario is trying to simulate.
• Why each phase appears in the chain.
• Which telemetry sources matter.
• What the analyst should search for.
• What detections should fire.
• Which false positives or tuning points should be considered.
• What success criteria should be used.

This is useful for training and validation. It turns generated events into an exercise that a SOC analyst, detection engineer, or CTI analyst can actually follow.

Named Scenario Library

Release 5.0 includes a library of named coherent scenarios.

Examples include:

• Web App to Endpoint Compromise.
• Password Spray to Valid Account Foothold.
• SQL Injection to Data Theft.
• Recon to Web Shell Persistence.
• Valid Account to LSASS Access.
• Password Spray to Exfiltration.
• XSS Canary to Session Abuse.
• SSRF Metadata Probe to C2.
• Ransomware Precursor Chain.
• Living-off-the-Land Transfer and Execution.
• Internal Discovery After Foothold.
• Web Enumeration to Password Spray.
• Public App Exploit to Persistence.
• Credential Dump to Cloud Upload.
• Signed Binary Proxy to C2.
• FIN7-style web, identity, and persistence flow.
• APT29-style identity and PowerShell flow.
• Lazarus-style delivery and exfiltration flow.
• Noisy red-team drill.
• Stealthy low-volume intrusion chain.
• WAF bypass retry chain.
• Service account abuse.
• External recon to credential access.
• C2 telemetry validation.
• Persistence control validation.

These are not meant to prove that a real actor attacked you. They are templates for detection validation and training. They help answer questions like:

• Does my SIEM parse this source?
• Does my correlation rule see the sequence?
• Does the detection alert only on one event or on the chain?
• Can analysts reconstruct the story from logs?
• Which telemetry source is missing?
• Where do false positives appear?

Safety Boundaries

Attack Simulation must be safe by design.

The v5.0 module follows several boundaries:

• It does not execute malware.
• It does not run arbitrary commands.
• It does not exploit arbitrary external targets.
• Web simulation traffic is limited to predefined benign canaries against the local lab target.
• SIEM forwarding sends generated Attack Simulation telemetry.
• Unsafe URL schemes and metadata/link-local destinations are blocked.
• Credentials used for forwarding are used only for the current request and are not stored.

This matters because the target user is a defender. The feature is built for detection engineering, parser validation, SOC drills, and authorized lab workflows.

How This Fits Detection Engineering

Detection engineering is not only writing rules. It is a lifecycle:

1. Understand the adversary behavior.
2. Map it to ATT&CK or another behavior model.
3. Identify required telemetry.
4. Confirm that telemetry exists.
5. Confirm that parsing works.
6. Write detection logic.
7. Test the logic with realistic events.
8. Tune false positives.
9. Document assumptions and gaps.
10. Re-test when infrastructure or parsers change.

AdversaryGraph v5.0 tries to support this lifecycle directly.

The CTI modules help with steps 1 and 2.

IOC and malware modules help enrich the investigation context.

Asset attack-surface mapping helps identify relevant entry points.

Attack Simulation helps with steps 3 through 8.

Reports and docs help with steps 9 and 10.

Architecture Overview

The self-hosted platform is built around a browser frontend and API backend.

At a high level:

• Frontend: React/Vite user interface.
• Backend: FastAPI service.
• Database: PostgreSQL for stored investigations and platform data.
• Background jobs: Redis/Celery where needed.
• ATT&CK data: synchronized from MITRE sources.
• AI providers: operator-configured providers such as Claude, OpenAI, Gemini, MiniMax, or local OpenAI-compatible services.
• Malware workflow: MalwareGraph-backed analysis components.
• Attack lab: Docker-based target services for controlled telemetry generation.
• SIEM forwarding: HTTP(S) delivery to configured collectors.

For the v5.0 web simulation flow, the important architectural distinction is:

AdversaryGraph does not simply invent an access log line for the UI. It sends real HTTP requests to the lab web target, and the lab web target emits server-side logs.

For AI-generated complicated scenarios, the goal is different. The assistant generates source-shaped telemetry for SIEM parser and detection validation. This is not proof of compromise, and it is not a replacement for live lab execution. It is a defensive validation tool for testing ingestion, parsers, correlation, dashboards, and analyst workflows.

Example Use Case: Password Spray Detection

A common detection engineering task is password spray validation.

The analyst wants to know:

• Do we ingest authentication failures?
• Are usernames parsed correctly?
• Can we count failures across many users?
• Can we detect one source trying one password against many accounts?
• Can we correlate a later successful login?
• Can we connect the successful login to endpoint activity?

With AdversaryGraph v5.0, the workflow becomes:

1. Select a credential-access or brute-force related TTP.
2. Choose the password spray scenario.
3. Run the lab or AI-assisted flow.
4. Observe authentication-related events.
5. Forward the events to the SIEM.
6. Confirm the parser.
7. Confirm the rule.
8. Review the chain graph.
9. Use Explain Attack to document what should have happened.
10. Record gaps.

The important part is the chain. A single 4625-like event is not enough. A realistic validation should include many failures, many users, timing, source consistency, and possibly one later success.

Example Use Case: Web Recon to Exploit-Shaped Telemetry

For a web application detection scenario, the analyst may want to test:

• Path discovery.
• Sensitive file probing.
• SQL injection-shaped requests.
• XSS-shaped requests.
• SSRF-shaped requests.
• WAF canary classification.
• Access-log parser behavior.
• SIEM dashboards for web attacks.

AdversaryGraph can run approved web canaries against the lab web target, then show the real target-side logs in the UI.

This lets the detection engineer validate more than a rule. It validates whether the web tier emits usable logs and whether the SIEM receives enough context to detect the behavior.

Example Use Case: Malware Findings to Detection Validation

The malware module can produce findings such as:

• Suspicious imports.
• Strings.
• Packed sample indicators.
• Function-level behavior.
• Potential IOCs.
• ATT&CK candidates.
• AI-assisted summaries.

Those findings can feed detection engineering:

• Which API calls should we monitor?
• Which command lines or process patterns matter?
• Which persistence mechanisms appear?
• Which network indicators are useful?
• Which behaviors should become validation scenarios?

AdversaryGraph’s value is that malware findings do not stay isolated in a reverse-engineering note. They can be connected back to ATT&CK and validation planning.

Example Use Case: Asset Inventory to Attack Surface

Asset inventories often live in spreadsheets, CMDB exports, or scanner output. The security team may know what exists, but not how to translate that into likely ATT&CK entry points.

The Asset Attack Surface module helps with:

• Normalizing assets.
• Identifying exposed services.
• Scoring exposure.
• Mapping likely entry points.
• Proposing ATT&CK candidates.
• Creating saved cases.

This connects directly to Attack Simulation because a high-risk public web application or VPN service should map to validation scenarios around external discovery, exploitation attempts, credential attacks, and logging coverage.

What This Release Is Not

It is important to define what v5.0 is not.

It is not an autonomous attack platform.

It is not a malware execution system.

It is not a replacement for a full cyber range.

It is not attribution proof.

It is not a guarantee that a detection works in production.

It is an analyst-assistance and validation platform. Its output should be reviewed by qualified analysts and detection engineers before operational use.

What Makes v5.0 Different

The main difference is the connection between CTI and validation.

Many tools stop at one of these points:

• Visualize ATT&CK.
• Extract TTPs.
• Store IOCs.
• Generate sample logs.
• Run a lab attack.
• Forward events.

AdversaryGraph tries to connect these into one workflow:

1. Understand the behavior.
2. Map it.
3. Enrich it.
4. Simulate it safely.
5. Observe telemetry.
6. Send it to the SIEM.
7. Explain what happened.
8. Document what passed and what failed.

That is the direction I want the platform to continue moving.

Getting Started

If you want to explore the public interface:

AdversaryGraph Web - Public ATT&CK Workspace for AdversaryGraph | 1200km

If you want the full private platform:

git clone https://github.com/anpa1200/adversarygraph.git
cd adversarygraph
cp .env.example .env
docker compose up

Then open:

http://localhost:3000

Read the full documentation here:

AdversaryGraph Documentation - CTI-to-Detection Workbench | 1200km

Attack Simulation guide:

Attack Simulation | AdversaryGraph Documentation - CTI-to-Detection Workbench | 1200km

Project page:

AdversaryGraph AI - CTI-to-Detection Platform

GitHub release:

Release AdversaryGraph v5.0.0 · anpa1200/adversarygraph

Final Thoughts

AdversaryGraph v5.0 is a step toward a more complete CTI-to-detection workflow.

The platform is still built around a simple idea: intelligence should not end as a static report. It should become a mapped, enriched, validated, and explainable defensive workflow.

With Attack Simulation, SIEM forwarding, real lab telemetry, AI-assisted scenario generation, and attack-chain explanation, v5.0 moves AdversaryGraph closer to that goal.

The next challenge is to continue improving realism: more telemetry sources, more lab targets, better parser validation, stronger scenario libraries, and deeper connections between malware analysis, asset exposure, and detection engineering.

If you work in CTI, SOC operations, detection engineering, malware analysis, or purple-team validation, I would be glad to hear feedback.

Project:

https://github.com/anpa1200/adversarygraph

Documentation:

https://1200km.com/adversarygraph-docs/

Live workspace:

AdversaryGraph Web - Public ATT&CK Workspace for AdversaryGraph | 1200km

Main page:

Andrey Pautov - CTI & Detection Engineering

AdversaryGraph v5.0: From CTI Mapping to Attack Simulation and SIEM Validation was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

The release, which Anthropic describes as "the most agentic Sonnet model yet," makes Sonnet 5 the default model for users on Anthropic's Free and Pro plans, while also making it available to Max, Team, and Enterprise customers. Introductory API pricing is set at $2 per million input tokens and $10 per million output tokens through August 31, after which it rises to $3 and $15 respectively — still well below the $5 input and $25 output pricing of Anthropic's top-of-the-line Opus 4.8.

The strategic logic is unmistakable: Anthropic is trying to democratize access to capabilities that until very recently only its most expensive models could deliver, while building the kind of broad-based developer adoption that will look attractive in an S-1 filing.

Sonnet 5 benchmarks show the mid-tier model closing in on Anthropic's flagship Opus

Sonnet 5 posts major gains over its predecessor, Sonnet 4.6, across every evaluation Anthropic disclosed. On SWE-bench Pro, an agentic coding benchmark, Sonnet 5 scores 63.2% compared with Sonnet 4.6's 58.1% — a jump that brings it within striking distance of Opus 4.8's 69.2%. On Terminal-Bench 2.1, another coding evaluation, the gap narrows further: 80.4% for Sonnet 5 versus 67.0% for Sonnet 4.6 and 82.7% for Opus 4.8.

In multidisciplinary reasoning, as measured by Humanity's Last Exam, Sonnet 5 scores 43.2% without tools and 57.4% with tools — the latter figure essentially matching Opus 4.8's 57.9%. On computer use tasks evaluated through OSWorld-Verified, Sonnet 5 reaches 81.2%, up from 78.5%. And on GDPval-AA v2, a knowledge-work benchmark, it scores 1,618 — surpassing Opus 4.8's 1,615 and far exceeding Sonnet 4.6's 1,395.

The pattern across these evaluations tells a consistent story: Sonnet 5 doesn't merely inch forward from its predecessor. It vaults into a performance tier that overlaps substantially with Anthropic's flagship model, while costing roughly 60% less per token at standard pricing and even less during the introductory period.

Enterprise partners say Sonnet 5's agentic AI capabilities finish jobs that previous models abandoned

The emphasis on agentic capabilities — the ability to plan, use tools like browsers and terminals, and execute multi-step workflows autonomously — reflects where the AI industry's center of gravity has shifted in 2026. Enterprises are no longer simply asking chatbots questions; they are deploying AI systems that can navigate complex software environments, execute multi-step coding tasks, and operate with minimal human supervision.

Early access partners painted a picture of a model that doesn't just start tasks but finishes them. Sualeh Asif, co-founder of Cursor, the AI-powered code editor that has become a bellwether for developer tool adoption, said that "with Claude Sonnet 5, agents stay on plan, follow our conventions, and ship clean multi-step changes, all at an efficient cost." Daniel Shepard, a senior engineer at Zapier, described handing the model a two-part automation job — updating Salesforce account tiers and sending a launch announcement — that "used to stall halfway" with previous models but now completes end to end.

These testimonials matter because they describe exactly the kind of reliability gap that has kept many enterprises from moving agentic AI from pilot programs to production deployments. A model that gets 80% of the way through a complex task before stalling creates more problems than it solves; one that reliably completes the full workflow changes the economics of automation. Anthropic also introduced cost-performance curves showing that developers can now adjust effort levels across Sonnet 5 and Opus 4.8 to find the optimal balance of cost and accuracy for their specific use case — a granularity that reflects growing sophistication in how enterprises consume AI services.

An updated tokenizer boosts Sonnet 5 performance but could quietly raise costs for some workloads

One technical detail buried in the announcement's footnotes deserves attention: Sonnet 5 uses an updated tokenizer that changes how the model processes text, similar to the change Anthropic introduced with Opus 4.7.

The tradeoff is that the same input can map to roughly 1.0 to 1.35 times as many tokens depending on content type. Anthropic says the introductory pricing is calibrated to make the transition "roughly cost-neutral," but enterprise customers running high-volume workloads will want to benchmark their specific use cases carefully before assuming their bills won't change.

Anthropic says Sonnet 5 is safer than its predecessor, but its most capable models still lead on alignment

Anthropic's safety disclosures reveal a nuanced picture. The company reports that Sonnet 5 shows lower rates of hallucination and sycophancy than Sonnet 4.6, is better at refusing malicious requests, and is more resistant to prompt injection attacks in agentic contexts. On Anthropic's automated behavioral audit — which tests for a wide range of misaligned behaviors including cooperation with misuse and deception — Sonnet 5 scored lower (meaning safer) overall than Sonnet 4.6.

However, Sonnet 5 showed "somewhat higher rates of misaligned behavior" compared with the more capable Opus 4.8 and Anthropic's Claude Mythos Preview, the company's powerful but tightly restricted cybersecurity-focused model. On a Firefox 147 exploit development evaluation created in collaboration with Mozilla, neither Sonnet model could develop a working exploit — both scored 0.0% — though Sonnet 5 showed a slightly higher partial success rate (13.2%) than Sonnet 4.6 (8.8%). Both remain far below Opus 4.8 (68.8% working exploits) and Mythos 5 (88.4%).

Because of these incremental gains in cyber-adjacent capabilities, Anthropic launched Sonnet 5 with cyber safeguards enabled by default — real-time systems that detect and block dangerous cybersecurity usage. The safeguards mirror those on Opus 4.7 and 4.8 but are less restrictive than those applied to Fable 5, the latest Mythos-class model that Bloomberg reported on June 10 is "blocked from responding to queries related to cybersecurity and biology." Organizations enrolled in Anthropic's Cyber Verification Program automatically receive the same access on Sonnet 5 without needing to reapply.

From $14 billion to $47 billion in revenue: Sonnet 5 arrives as Anthropic's IPO narrative takes shape

The Sonnet 5 launch arrives at what may be the most consequential moment in Anthropic's short history. The company confidentially filed its IPO prospectus with the SEC in early June, setting up what CNBC has described as "the most scrutinized public offering in tech history."

The financial trajectory has been extraordinary. In February, Anthropic raised $30 billion at a $380 billion valuation, with the company reporting $14 billion in annualized revenue that had "grown more than tenfold in each of the past three years," as The Guardian reported. 

By late May, Anthropic had closed a $65 billion Series H round at a $965 billion post-money valuation — co-led by Altimeter Capital, Sequoia Capital, and others — with a revenue run rate that had crossed $47 billion. Harrison Rolfes, an analyst at PitchBook, told CNBC that the number that will "either validate or collapse the entire narrative the private markets have been pricing for three years" won't be the valuation or revenue, but gross margin — a figure no outside observer has yet seen.

In this context, Sonnet 5 serves a dual purpose. For developers, it offers genuine capability improvements at competitive prices. For Anthropic's IPO narrative, it demonstrates the company can deliver a compelling product at a price tier that could drive the kind of broad adoption Wall Street rewards — high-volume, recurring API revenue from thousands of enterprise customers.

Government deals and growing competition define the market Sonnet 5 enters

The timing also aligns with Anthropic's aggressive push into institutional contracts. Just yesterday, California Governor Gavin Newsom announced a first-of-its-kind partnership providing Claude to all state agencies at a 50% discount, with free workforce training.

Kate Jensen, Anthropic's Head of Americas, called it an effort to "put Claude to work for the people who keep this state running." The deal — which extends to California's cities and counties — represents exactly the kind of durable, recurring adoption that could anchor revenue well beyond the developer community.

But Anthropic's release lands in an increasingly crowded field. OpenAI, which raised a $122 billion round in March at an $852 billion valuation, is pursuing its own IPO. Elon Musk's SpaceX, which merged with xAI, priced its IPO at $135 per share with a $1.77 trillion valuation. Google, Meta, and a growing wave of well-funded competitors — including Asian AI startups that, as the Wall Street Journal has reported, are developing Mythos-like cybersecurity capabilities — are all vying for the same enterprise market.

Gil Luria, head of technology research at D.A. Davidson, told CNBC that while Anthropic "appears to have the lead" in frontier AI models, "much of their current usage is for trials and experimentation and that may not sustain." That observation cuts to the heart of the challenge facing every frontier AI lab: converting experimental developer usage into durable, production-grade revenue.

The real test for Sonnet 5 isn't benchmarks — it's whether cheaper AI can sustain a trillion-dollar story

Sonnet 5's positioning — offering near-Opus performance at Sonnet prices — is a direct play for that conversion. Enterprise customers experimenting with expensive Opus-class models may find that Sonnet 5 delivers sufficient quality for production workloads at a price point that finance teams can approve at scale. If it works, it could accelerate the shift from experimentation to deployment that every AI company needs to justify its valuation.

Three things will determine whether Sonnet 5 matters beyond the initial benchmark charts. Real-world agentic reliability is the first: benchmarks measure capability, but production deployments measure consistency, and the true test will come when thousands of developers push the model through messy, unpredictable workflows at scale.

The tokenizer economics are the second: the updated tokenizer's 1.0 to 1.35x token expansion could quietly erode the pricing advantage for certain workloads, and enterprise customers should run their own cost analyses rather than relying on headline per-token prices. The third is the IPO narrative itself: when Anthropic's S-1 eventually becomes public, investors will scrutinize whether the Sonnet tier — cheaper but high-volume — or the Opus tier — expensive but high-margin — drives the bulk of revenue and, critically, gross profit.

As PitchBook's Rolfes told CNBC, the 2026 IPO window "either becomes the most consequential IPO cycle since the dot-com era or the most expensive lesson in narrative-versus-fundamentals that public markets have ever taught."

Anthropic is betting that a model good enough to rival its flagship and cheap enough to run at scale is the product that closes the gap between those two outcomes. The public markets will soon decide whether they agree.

Developed to fundamentally disrupt closed-source enterprise dominance in autonomous software engineering, the 1.6-trillion-parameter Mixture-of-Experts (MoE) system brings a native 1-million-token context window to the public domain under a highly permissive, enterprise grade, commercially viable MIT license.

Commercial access to the architecture introduces a highly aggressive pricing tier, deploying a mechanism where all context-cache hits are processed completely free of charge, running alongside a time-limited "Token Pack" flash-sale paradigm. There's also a typical "pay-as-you-go" API for non-cache hits standard priced at $0.75/$2.95 per million tokens in/out.

However, a limited-time promotional discount aggressively slashes these operational expenditures down to $0.30 per million tokens for uncached input and $1.20 per million tokens for output, both on the cheaper-end of top performing models globally.

What makes the release a definitive inflection point for global tech infrastructure is its operational independence: the massive model was trained entirely on a cluster of over 50,000 domestic Chinese Application-Specific Integrated Circuits (ASICs), proving that near-frontier AI models can be scaled successfully without relying on the typical U.S. Nvidia GPUs that have, to date, powered much of the global generative AI frontier model training effort.

This successful deployment of alternative silicon signals a profound structural shift. If Chinese conglomerates can consistently iterate trillion-parameter architectures using homegrown ASICs rather than general-purpose GPUs, it would seem to threaten Nvidia's dominance in this sector.

Crucially, this technological pivot arrives precisely as Washington pressures top-tier American labs to restrict access to their latest models. Following a U.S. governmental request, OpenAI was forced to limit access to its new GPT-5.6 models, while Anthropic was previously also ordered by the U.S. to restrict access to its latest Claude Fable 5 / Mythos 5 models, which it took entirely offline in response. At the same time, a growing chorus of technologists, activists, and industry experts warn that these defensive regulatory maneuvers have inadvertently backfired. By locking down Western closed-source models and driving up API costs, the U.S. government has left a wide operational window for global developers seeking affordable, high-performance alternatives like those found in Chinese open source models such as Meituan LongCat-2.0.

The raw operational metrics backed up the developer enthusiasm: during its unbranded residency on OpenRouter, Owl Alpha accounted for approximately 10.1 trillion monthly tokens—averaging 559 billion tokens per day—representing a 242% month-over-month explosion in volume that propelled it into the platform's global top three.

By the time Meituan stepped forward to claim the architecture, the model had already secured the top ranking on the Hermes Agent workspace, second place on Claude Code deployments, and third place across international OpenClaw environments.

Technology: Engineering the 1M-Token Sparse Context

At the core of LongCat-2.0 lies an aggressive optimization of Mixture-of-Experts (MoE) sparsity, scaling total parameters to 1.6 trillion while limiting active computation to an average of 48 billion parameters per token.

Depending on the structural complexity of a query, the model’s dynamic activation ranges from 33 billion to 56 billion parameters. This design implements a "Zero-Compute Experts" framework, ensuring that routine execution elements pass through lighter subnetworks, entirely eliminating the idle computational overhead that typically penalizes ultra-dense models.

To sustain a functional 1-million-token context window without incurring catastrophic hardware bottlenecks, Meituan introduced LongCat Sparse Attention (LSA). Designed as an evolutionary iteration of DeepSeek Sparse Attention, LSA resolves the quadratic scoring costs and memory fragmentation that typically plague fine-grained sparse mechanisms through three distinct, orthogonal vectors:

• Streaming-aware Indexing (SI): This system restructures the token selection pipeline by blending hardware-aligned contiguous data reads with dynamic random selection. By converting fragmented memory access into highly predictable, sequential blocks, the system achieves coalesced High Bandwidth Memory (HBM) utilization and elevated effective bandwidth.

• Cross-Layer Indexing (CLI): Leveraging the empirical reality that attention saliency remains highly stable across adjacent hidden layers, CLI amortizes calculation costs. A single indexing pass successfully guides multiple consecutive layers during inference, a capability reinforced by cross-layer distillation throughout the training phase.

• Hierarchical Indexing (HI): This approach applies a coarse-to-fine, two-stage scoring layout. The indexer performs a rapid, approximate block-level recall to filter candidates, before running fine-grained token selection exclusively on the remaining population.

Furthermore, Meituan integrated an N-gram Embedding module inherited from its lighter model lines. By expanding parameter allocation in sparse dimensions completely orthogonal to the MoE expert layout, the architecture appends 135 billion parameters to a 5-gram token combination framework.

This expands the core embedding space by roughly 100-fold, allowing the model to capture dense local token relationships and accelerate large-batch inference operations by reducing memory Input/Output (I/O) bottlenecks.

Product: Post-Training, MOPD Framework and Benchmark Performance

While generalist large language models prioritize fluid, conversational interfaces, LongCat-2.0 focuses explicitly on multi-step engineering tasks, tool integration, and automated repository manipulation — agentic tasks, in other words.

In standardized assessments, LongCat-2.0 registers an empirical 59.5 on SWE-bench Pro, surpassing GPT-5.5's benchmark of 58.6. The model further establishes its agentic specialization by marking a 70.8 on Terminal-Bench 2.1, a 77.3 on SWE-bench Multilingual, and a 73.2 on the general corporate workflow simulator FORTE.

This precise operational behavior is achieved through a structural post-training layer called Multi-Teacher Optimization via Mixture of Specialized Experts (MOPD). Rather than blending raw human feedback into a singular reward function, the MOPD architecture segregates post-training optimization into three independent, highly focused expert clusters.

• The Agent Experts are fine-tuned strictly for structural execution, specializing in precise tool invocation, multi-turn API parameter parsing, and self-correcting loop mechanisms to avoid execution stagnation.

• The Reasoning Experts are optimized in isolation to advance multi-hop logic, complex chain-of-thought engineering, mathematics, and high-level STEM problem-solving.

• The Interaction Experts focus entirely on human alignment, instruction-following nuances, factual grounding to suppress hallucinations, and maintaining rigid safety guardrails without diminishing the model's overall utility.

By segregating these vectors during post-training, LongCat-2.0 prevents functional degradation. A dynamic gate-routing mechanism then seamlessly fuses these specialized behaviors at runtime, allowing the final model to coordinate deep reasoning, stable tool execution, and safe user interaction simultaneously

While LongCat-2.0 generally trails premium frontier systems like Claude Opus 4.8 across broad general-agent benchmarks such as FORTE and BrowseComp, it explicitly punches above its weight in software engineering.

What makes this open-weight architecture special is its hyper-focus on autonomous development; it manages to narrowly exceed OpenAI's proprietary GPT-5.5 on the rigorous software engineering benchmark SWE-bench Pro (scoring 59.5 against 58.6), proving it is highly capable and fiercely competitive for complex coding tasks despite a leaner computational footprint.

Commercial Framework: Pay-As-You-Go vs. Flash-Sale Token Packs

Meituan's deployment strategy introduces a specialized commercial model that splits network access between conventional real-time API billing and structured "Token Packs".

For traditional enterprise integration, standard top-up accounts are available, deducting operational capital in real time based directly on token input and generation metrics.

However, to accommodate the unpredictable compute bursts characteristic of autonomous development agents, Meituan launched a structured Token Pack framework. Purchased as fixed, one-time volumetric allocations valid for a strict 30-day window, these packages stack directly on top of an organization's existing baseline API account.

To manage network load across its ASIC clusters, Meituan releases these high-volume packages via limited flash sales four times daily, precisely at 10:00, 16:00, 21:00, and 23:00 Beijing Time on a first-come, first-served basis.The economic standout of this framework is the zero-charge processing of context cache hits.

In massive agentic environments where a coding assistant must repeatedly read, reference, and modify the same multi-million-token code repository over an extended session, standard architectures penalize developers by charging full pricing for repeated input context.

Under Meituan's infrastructure, only cache-miss inputs and final token generations consume the package quota. This architecture completely alters the operational cost economics of large-scale agent software development, enabling deep iterative context exploration without compounding costs.

Licensing: Open-Source Structural Freedom

By registering the LongCat-2.0 repository under the open-source MIT License, Meituan positions the architecture with maximum legal flexibility for enterprise integration.

In contrast to copyleft paradigms like the GNU General Public License (GPL)—which legally obligates developers to open-source any derivative frameworks or internal software that links to the code—the MIT license permits near-unrestricted freedom.

For corporate engineering teams, this legal standard ensures that LongCat-2.0 can be deeply modified, compiled, and hard-coded directly into closed-source commercial applications, proprietary dev tools, and internal automation backends.

Corporations can fork the repository, optimize the internal LSA mechanisms for private databases, and sell the resulting software stack to end users without any obligation to disclose their proprietary intellectual property or structural enhancements.

Meituan's Evolution: From Delivery Super App to AI Powerhouse

Founded in March 2010 by serial entrepreneur Wang Xing, Meituan initially launched as a Groupon-style daily deals website before rapidly evolving into one of China’s dominant “super apps”.

Following a massive 2015 merger with Dianping, the Beijing-based tech giant solidified a dominant market share over the country's urban delivery corridors, bridging local consumer reviews, instant retail, hotel bookings, and food delivery. Operating as a publicly traded powerhouse on the Hong Kong Stock Exchange, Meituan claims over 770 million annual transacting users and supports a network of more than 14.5 million merchants.

However, faced with intense domestic market competition, severe margin compression, and a sliding profit margin, the company aggressively pivoted its strategy beyond logistics. Meituan publicly committed to investing "billions" into artificial intelligence and domestic chip capabilities to revitalize its technology-driven offerings.

This strategic shift into the global AI race began materializing in late 2025 with the release of LongCat-Flash, a 560-billion-parameter Mixture-of-Experts foundation model, followed quickly by the advanced reasoning model LongCat-Flash-Thinking. By open-sourcing these frontier-class models under enterprise-friendly licenses, Meituan signaled its ambition to become a foundational player in global AI infrastructure rather than remaining strictly a regional e-commerce and delivery giant.

Enterprise Implications: Autonomous Operational Workflows

For modern enterprises, the release of LongCat-2.0 unlocks clear operational strategies across software engineering, system operations, and long-form data interpretation.

The combination of an open-weight, MIT-licensed model with an expansive 1-million-token context window means organizations can bypass the data privacy concerns and recurring overhead associated with hosting proprietary third-party APIs.In large-scale enterprise development environments, teams can leverage the model's specialized Agent Experts to orchestrate autonomous codebase migrations.

Instead of dedicating hundreds of developer hours to manually rewriting legacy application frameworks, engineers can pass an entire enterprise repository along with modern SDK documentation directly into the 1-million-token context window. LongCat-2.0 can map the dependencies, execute the repository-level structural updates, compile the new codebase, and catch compilation and execution bugs autonomously within local sandbox environments before generating a final pull request.

The model's architectural separation via the MOPD gate-routing mechanism yields significant advantages for strict enterprise compliance. By routing specific operational queries through isolated expert clusters, a financial institution or healthcare firm can deploy deep logic and mathematical reasoning passes without risking factual hallucination or violating strict safety bounds.

The Interaction Experts function as an implicit guardrail layer, suppressing errors and enforcing instruction-following protocols without degrading the raw processing power of the internal Reasoning Experts. Combined with the zero-cost caching model, enterprises can maintain hyper-focused autonomous software networks that can repeatedly inspect corporate data pools, continuously maintaining and optimizing internal infrastructure at a fraction of standard operational costs.

The model supports 170 languages across 10 language groups, accepts PDF, DOC, PPT, and OpenDocument formats, and can be deployed as a single container on an organization's own infrastructure — a capability Mistral is positioning directly at enterprises in regulated industries that cannot route sensitive documents through U.S.-jurisdiction cloud APIs.

"Mistral OCR 4 extracts and structures content from a wide range of documents," the company said in its announcement. "Where previous generations focused on converting a page into clean text and tables, OCR 4 returns a structured representation of the document."

The model is available immediately through the Mistral API, Document AI in Mistral Studio, Amazon SageMaker, and Microsoft Foundry, with Snowflake Parse Document support coming soon. Pricing starts at $4 per 1,000 pages, dropping to $2 per 1,000 pages through a batch API discount.

OCR 4 treats every document as a semantic map, not a wall of text

The central engineering shift in OCR 4 is structural. Rather than outputting a flat stream of extracted text — the paradigm that has defined OCR for decades — the model returns a layered representation in which every block is localized with a bounding box, classified by type (title, table, equation, signature, and others), and scored for confidence at both the page and word level.

Mistral says bounding boxes were its most-requested capability. The reason is straightforward: without location data, downstream systems cannot trace an extracted fact back to its source on a specific page. That traceability gap has been a persistent friction point for enterprises building retrieval-augmented generation (RAG) pipelines, compliance workflows, or any application where "where did this number come from?" is a question that needs an auditable answer.

Block classification addresses a related problem. A paragraph tagged as a "title" can segment a document into hierarchical chunks for semantic search. A block tagged as a "table" can be routed to a structured-data pipeline rather than a text summarizer. A block tagged as a "signature" can trigger a redaction workflow in a compliance system.

These are not novel ideas in isolation, but packaging them as first-class outputs of the OCR model itself — rather than requiring a separate layout-analysis stage — removes an integration layer that enterprise teams have historically had to build and maintain themselves.

The confidence scores serve a dual purpose. At scale, they allow organizations to programmatically route low-confidence regions to human reviewers and auto-approve high-confidence extractions, building what the industry calls human-in-the-loop verification without requiring a person to review every page of every document. In production systems, OCR is rarely the end goal — it is the first step in a larger pipeline.

Developers building RAG systems, agent workflows, or document automation often spend more time reconstructing layout and structure than on the downstream AI logic itself. OCR 4 aims to eliminate that reconstruction step, and if it delivers on that promise, the value accrues not just in OCR cost savings but in reduced engineering hours across the entire document pipeline.

Independent reviewers preferred Mistral's output 72 percent of the time, but benchmarks tell a complicated story

Mistral reports that OCR 4 achieved a 72% average win rate in a head-to-head human evaluation against leading competitors, conducted by independent annotators across more than 600 real-world documents in over 12 languages. The model also achieved the top overall score on OlmOCRBench at 85.20 and scored 93.07 on OmniDocBench.

But the company itself urges caution in interpreting those numbers. In its release, Mistral took the unusual step of auditing and publicly disclosing the specific types of scoring artifacts it encountered, including ground-truth errors in the reference annotations, equivalent LaTeX notation scored as mismatches, column-reading-order assumptions, and header/footer attribution issues. "We therefore treat the aggregate score as directional rather than definitive," the company said — a notably transparent stance from a vendor announcing a product.

That transparency is well-timed. On the public OlmOCRBench leaderboard, some researchers have noted that OCR 4 currently ranks third, behind open models like Chandra OCR 2. And some open-weight models self-report higher OmniDocBench composite scores — PaddleOCR-VL-1.6 claims 96.33 — though those results have not been independently reproduced on the public leaderboard.

Early enterprise feedback has been favorable nonetheless. Aidan Donohue, an AI engineer at financial AI firm Rogo, said the company benchmarked OCR 4 against leading agentic document parsers on a chart-dense financial QA dataset and "reached equivalent accuracy at roughly 8x lower cost and 17x lower latency." Ivan Mihailov, an AI engineer at intellectual property management firm Anaqua, said OCR 4 is "roughly 4x faster per page than our incumbent provider." 

Enterprise buyers, however, should run their own evaluations rather than relying on any vendor's benchmark numbers. The practical question is not which model scores highest on a leaderboard, but which model produces the fewest errors on your specific documents, in your specific languages, at a price and latency that fit your workflow.

The Anthropic export ban gave Mistral's sovereignty pitch the proof point it needed

Mistral's release lands in a geopolitical context that could hardly be more favorable for its strategic positioning.

On June 12, Anthropic was forced to disable all access to its newest AI models, Fable 5 and Mythos 5, after the U.S. Commerce Department used national security export controls to bar the company from distributing the models to any foreign national. Enterprise clients in finance, healthcare, SaaS, and critical infrastructure found their core intelligence services abruptly disabled, without prior warning or effective recourse. As of June 24, both models remain offline, with prediction markets giving only 57% odds of restoration before July 1.

That episode validated a warning Mistral CEO Arthur Mensch has been sounding for over a year. As Business Insider reported, Mensch warned at London Tech Week in June 2025 about American AI companies "having the keys" for their models, calling it a scenario where European companies are "giving leverage to their providers." He added: "At some point, you need to be able to turn it off or turn it on, and you don't want to leave it to another country."

The argument gained further urgency as Mensch's broader sovereignty pitch escalated in recent months. As reported by CNBC in late May, Mensch told the outlet: "Europe is lagging behind when it comes to [the] buildout of infrastructure, and so we are investing to close that gap." 

At the same time, Mensch pushed back against Pope Leo XIV's call for AI to be "disarmed," arguing that Europe cannot afford to fall behind U.S. tech giants. "We're all for ​peace, but if you look at our rivals and adversaries in the world, they're using artificial ​intelligence … we do need to have our own capabilities," Mensch told reporters.

OCR 4's single-container, self-hosted deployment model is the product-level expression of that argument. A U.S.-headquartered provider offering EU data residency means documents are stored in Frankfurt but governed by U.S. law. Mistral, incorporated in France and operating under EU jurisdiction, offering on-premise containerized deployment, means documents never leave the customer's infrastructure at all. The EU AI Act's fine enforcement provisions take effect August 2, adding regulatory pressure to the compliance calculus for European enterprises evaluating document AI vendors.

Baidu's free, open-weight OCR model arrived one day earlier — and the contrast is revealing

Mistral's release did not arrive in isolation. Just one day before OCR 4 launched, Baidu shipped Unlimited-OCR on June 22 — a 3-billion-parameter MIT-licensed model that tackles one of the most persistent pain points in document AI: parsing entire PDFs and multi-page scans in a single forward pass, without chunking the input or stitching the output back together afterward.

Baidu's model uses a technique called Reference Sliding Window Attention (R-SWA) that, as a top Hacker News commenter explained, splits the AI's focus into two paths: maintaining full attention on the original document image while restricting memory of generated text to a tight, moving window. The result is constant KV cache size and the ability to transcribe 40-plus pages in a single forward pass. The model gathered 1,800 GitHub stars in its first 24 hours and racked up more than 479 upvotes on Hacker News, where the discussion thread ran to 109 comments.

The two releases frame what some analysts are calling the June 2026 document-AI split: self-hosted long-horizon parsing with open weights versus structured managed extraction with enterprise features.

Baidu's model is free under an MIT license, runs on standard GPU hardware, and has no managed API or enterprise SLA. Mistral's model is a commercial product with per-page pricing, bounding boxes, confidence scores, block classification, multi-platform distribution, and self-hosted deployment options for enterprise customers. 

Unlimited-OCR may be the better tool for a research team digitizing scanned dissertations on a single GPU. OCR 4 is built for the IT procurement process — the world of SLAs, data processing agreements, and compliance audits.

Beyond Baidu, the broader OCR competitive field includes Google Document AI, Amazon Textract, Azure Document Intelligence, ABBYY Vantage, and a growing number of open-weight models. 

On the Hacker News thread for Unlimited-OCR, practitioners offered a candid assessment of the state of the art. Joss82, who has worked on document parsing for 10 years, wrote bluntly: "OCR still sucks in 2026." Meanwhile, one user named SyneRyder reported success with Claude for OCR of hundreds of pages of handwritten documents, noting the model delivered results with "no corrections required" and even pointed out a continuity error in the source text. These practitioner reports underscore a key tension in the market: performance varies wildly depending on the specific document type, language, and quality of the source material.

The real play is not OCR — it is an enterprise AI stack with document intelligence as the on-ramp

Step back far enough, and Mistral's OCR 4 release is not really an OCR story. It is an enterprise go-to-market story built on top of a $4.4 billion global intelligent document processing market that is forecast to grow at a 33.1% compound annual growth rate through 2030, according to Grand View Research.

For Mistral, OCR is a wedge into enterprise AI budgets. The model feeds directly into Mistral's Search Toolkit, the company's open-source composable search framework announced at the AI Now Summit. In that architecture, OCR 4 serves as the ingestion layer for retrieval-augmented generation and enterprise search pipelines, converting raw documents into citation-ready, structurally classified input. The logic is clear: once an enterprise adopts OCR 4 for document extraction, Mistral's broader model suite — including Medium 3.5 for reasoning and the Vibe agentic platform for task execution — becomes the natural next step in the stack. 

That pipeline ambition is critical context for understanding Mistral's current fundraising trajectory. Bloomberg recently reported that the company is in early discussions to raise about €3 billion ($3.5 billion) at a valuation of roughly €20 billion — nearly double the €11.7 billion valuation from its September Series C round. To date, Mistral has raised only about $4 billion, a fraction of what its largest U.S. rivals have taken in. OCR 4 and its associated enterprise revenue pipeline are part of how the company plans to justify that higher valuation, with Mistral targeting €1 billion in revenue for 2026, up from €200 million in 2025, according to Le Monde.

Mistral is a company with roughly 1,000 employees and ambitions to compete with labs that have raised 40 times as much capital. It cannot win a general-purpose model arms race against OpenAI and Anthropic. What it can do is build a differentiated enterprise stack around sovereignty, structured document intelligence, and agentic workflows — and use that stack to capture European enterprise budgets that are increasingly wary of U.S. provider dependency. 

The pricing structure reinforces that strategy: at $2 per 1,000 pages in batch mode, the cost of processing a 100,000-page corporate archive falls to $200, making large-scale digitization projects economically viable in ways they may not have been with token-based vision-language model pricing.

Whether Mistral can execute that vision at scale — against Google, Amazon, Microsoft, and a surging open-source ecosystem — remains an open question. But the Anthropic export control crisis is still unresolved, European data sovereignty regulations are tightening, and a potential €20 billion funding round is on the horizon. The company is holding an OCR 4 production webinar on July 7 at 6:00 PM CET.

Two weeks ago, the argument for building AI infrastructure outside the reach of U.S. export controls was theoretical. Then the U.S. government flipped a switch, and Anthropic's most advanced models went dark for every non-American on the planet. Mistral did not cause that crisis — but it spent the last year building the product that makes it matter.

Every day, organizations learn things their AI systems never get to use.

A security analyst corrects an AI-generated investigation. A network engineer identifies the root cause of a recurring outage. An observability team discovers that a pattern of latency, logs and infrastructure changes predicts service degradation. A customer operations team learns which signals indicate an escalation is likely.

Each moment contains valuable organizational knowledge. But in most enterprises, that knowledge disappears into tickets, dashboards, chat threads, post-incident reviews and the minds of individual experts. It may help solve the immediate problem, but it rarely becomes part of a reusable system that improves future AI-driven decisions.

That is the next challenge for the agentic enterprise.

The future will not be defined simply by who has the most capable model or the most autonomous agents. Many organizations will have access to similar frontier models. Many will deploy agents across security, IT, engineering, customer service, and business operations.

The real differentiator will be whether those agents can learn from the organization around them.

Not by constantly retraining the underlying model, but by capturing operational experience, converting it into institutional knowledge and making that knowledge available to future agents, workflows, and decisions.

The agentic enterprise is not just an enterprise that uses AI. It is an enterprise that learns through AI.

Agentic enterprises allow AI systems to learn from them

The AI conversation has been dominated by model capability: larger context windows, better reasoning, faster inference, stronger tool use, and more sophisticated agentic behavior.

Those advances matter. But in the enterprise, a model is only one part of the system.

A model does not automatically know how a specific organization operates. It does not inherently know which remediation step solved last month’s outage, which analyst correction improved a threat investigation, which network signal preceded a service disruption, or which internal policy should override an otherwise plausible recommendation.

That knowledge belongs to the enterprise.

For agentic systems to improve, organizations need a way to capture that knowledge and make it reusable. In many cases, that does not require changing the model itself. It requires changing the ecosystem around the model: the knowledge base, retrieval layer, prompts, policies, guardrails, routing logic and workflows that shape how agents behave.

The model may remain the same. The learning system around it becomes smarter.

Feedback loops turn every outcome into a teachable moment for agents

Every agentic workflow creates signals.

An agent receives a request. It retrieves context, reasonsthrough possible actions, calls tools, and generates answers. A human accepts, rejects, or modifies that answer. Downstream systems reveal whether the action worked.

That entire chain is valuable.

AI observability gives organizations visibility into what happened: the prompt, response, reasoning path, tool calls, data sources, intermediate steps, failure modes and outcomes. Without that visibility, organizations cannot understand why an agent behaved the way it did, let alone improve it.

But observability alone is not enough.

The larger opportunity is to turn observed behavior into institutional knowledge. A trace should not only help a developer and operators debug an agent. It should help the enterprise understand what the agent learned, what the human corrected, what outcome followed, and what should change before the next similar event.

That is the shift from monitoring AI to teaching AI.

In the agentic enterprise, feedback loops connect action to outcome, outcome to knowledge and knowledge back to future action.

A learning system in practice across security, observability and the network

Consider a service experiencing intermittent degradation.

An observability agent detects unusual latency and error rates. A network agent identifies packet loss across a specific path. A security agent notices that the same time window includes suspicious authentication behavior and unusual traffic from a previously unseen source.

Individually, each agent has only a partial view. Together, they create a richer operational picture.

The first time this incident occurs, human experts may need to intervene. A network engineer confirms that packet loss was caused by a misconfigured routing change. A security analyst determines that the suspicious traffic was not an attack, but a side effect of a misrouted internal service. An SRE connects the network event to the application degradation.

That resolution contains knowledge the organization should not have to relearn.

A mature agentic learning system would capture the traces, human corrections, topology context, security findings, observability signals and final remediation steps. It would preserve the relationship between those signals: latency pattern, network path, identity behavior, routing change and remediation.

The next time a similar pattern appears, agents would not start from zero. They could retrieve the prior case, compare current conditions, recommend the proven diagnostic path and escalate with better context.

The underlying frontier model did not need to be retrained.

The enterprise learned.

The architecture of the learning agentic enterprise

A learning-oriented agentic enterprise needs more than a model or chatbot. It needs an architecture that can capture experience, turn it into usable knowledge, connect that knowledge to operational context, and govern how it changes future agent behavior.

Memory preserves what happened: what the agent saw, what it did, where humans intervened, and what outcomes followed.

Knowledge bases turn that experience into reusable guidance, including playbooks, examples, policies, procedures, and evidence.

A data fabric connects the operational environment. The signals agents need live across logs, metrics, traces, tickets, identity systems, security tools, network telemetry, collaboration platforms, and business applications. A data fabric makes those signals discoverable, correlated, governed, and usable in context.

AI observability explains how agents behave by capturing prompts, tool calls, intermediate steps, responses, feedback, and outcomes. That visibility helps organizations understand where agents succeed, where they fail, and what should improve.

The control plane governs how learning becomes change: what knowledge is promoted, which prompts or policies are updated, which agents can use new information, what approvals are required, and how changes are audited.

Together, these capabilities allow AI systems to improve over time in a controlled, trustworthy way that allows the enterprise to learn from its own operations.

The organizations that learn fastest will win

The next era of AI will not be won by models alone. It will be won by organizations that can capture what they learn from every workflow, expert correction, incident, investigation, and outcome.

The most advanced agentic enterprises will not simply deploy more agents. They will build systems that allow every agent to benefit from the collective knowledge of the organization.

That means connecting operational data through a data fabric. It means observing agent behavior deeply enough to understand it. It means preserving experience in memory and institutionalizing it in knowledge bases. It means using a control plane to govern how learning changes agent behavior.

The future of AI is not a single autonomous agent acting alone. It is an ecosystem of agents, humans, data and controls that learns over time.

The organizations that build that ecosystem will create AI systems that get better with every interaction. Not because the model is constantly changing, but because the enterprise itself is becoming more intelligent.

Learn more about how Cisco Data Fabric powered by the Splunk Platform is accelerating agentic operations.

Hao Yang is Vice President AI at Splunk, a Cisco Company.

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

Added

• Exported renderDelimitedThinking from the @oh-my-pi/pi-ai/dialect barrel so consumers can reuse the dialect's <thinking> envelope unwrap-and-rewrap logic (the only ./dialect/rendering primitive re-exported; the rest stay dialect-internal).

Fixed

• Fixed OpenAI Responses/Codex tool schema normalization stripping provider-rejected regex lookaround patterns from MCP tool parameter schemas. (#2784)
• Fixed OpenAI Responses parallel tool-call routing so late keyed argument deltas for a closed call are dropped instead of being appended to another open call.

@oh-my-pi/pi-coding-agent

Added

• Added support for LaTeX color commands (\textcolor, \colorbox, and \fcolorbox) in user-visible terminal prose and final chat to colorize output

Changed

• Changed STT dependency setup to validate recorder and model assets per stt.modelName, so switching speech models re-runs dependency checks and downloads for the new model
• Changed STT startup with cached models to warm the speech model in the background and defer full model loading until transcription begins, reducing push-to-talk start latency
• Allowed user-visible terminal and final-chat responses to include LaTeX math delimiters/commands and Mermaid ```mermaid diagrams
• Changed the hold-Space push-to-talk gesture to recognize a held bar from the regularity of the OS key auto-repeat rather than a raw space count or speed alone, so it no longer spams the editor, no longer eats deliberate space taps, and no longer triggers when the bar is smashed. Recording starts only after two consecutive inter-space deltas are "mechanical" — both fast (within ~120 ms) and near-identical, the metronomic signature of auto-repeat; the few pre-burst spaces typed are then tracked back out. Smashing (fast but jittery) and deliberate spacing (steady but slow) both keep typing real spaces and never start recording.
• Updated markdown Mermaid rendering to color ASCII diagrams with the active theme and automatically choose a narrower layout that better fits the terminal width
• Made the watched-session transcript sent to the advisor (and shown by /advisor dump) clearer: each turn now opens with a ### Session update heading; watched-agent roles render as inline **agent**: / **user**: labels instead of level-2 headings that collided with the advisor's own turns; consecutive same-role messages collapse under one label (the watched agent emits one assistant message per tool call); and batched updates are joined by a blank line rather than a --- rule.
• Changed the compact transcript tool-intent prefix (history://, /advisor dump) from # to // so intent lines read as comments instead of rendering as Markdown H1 headings.
• Changed the advisor advice injected into the primary transcript from a Advisor (...): - [severity] note prose block to one <advisory severity="…" guidance="weigh, don't blindly obey">…</advisory> element per note, with XML-escaped bodies. (Relocated the shared escapeXmlText helper to @oh-my-pi/pi-utils.)
• Reverted /dump and /advisor dump raw to the pre-16.x full verbose dump: system prompt, model/thinking config, tool inventory with parameters, and the message transcript rendered with markdown role headings (## User, ## Assistant, ### Tool Call: <name> with the call's _i intent as a // comment under the heading and the remaining arguments as a fenced YAML block, ### Tool Result: <name>, plus ## Bash Execution/## File Mention/summary sections) instead of the model's native-dialect turn envelopes and <invoke>/<parameter> XML tool calls. Dropped the compact default and the [raw] flag on /dump; the compact → tool(...) ⇒ ok history format is no longer reachable from /dump. /advisor dump still defaults to compact, and /advisor dump raw now renders the same markdown dump (previously the model's native-dialect envelopes).

Fixed

• Fixed Whisper STT cache detection to require both encoder and decoder .onnx files, so partial model downloads now trigger a proper foreground download instead of being treated as fully cached
• Fixed same-process JsRuntime cleanup so disposing an older inline/direct runtime no longer deletes a newer runtime's JS helper globals; inactive cmux/direct runtimes now re-activate their globals before sequential use while overlapping cross-runtime runs fail explicitly.
• Fixed magic-keyword steering notices (ultrathink-notice, orchestrate-notice, workflow-notice) to be prepended before the related user message so they influence that same turn
• Fixed dequeuing or popping queued user messages to remove their preceding hidden magic-keyword notice companions, preventing orphaned queued notices
• Fixed queued user steers to auto-resume after interrupts even when the transcript tail is a preserved advisor card or other non-conversational custom message
• Fixed queued user follow-up messages to remain queued after an interrupt and only run on explicit resume, even when an IRC wake leaves a provider-valid tail
• Fixed stranded IRC asides to wake a response turn after interruption instead of remaining pending
• Fixed accepted IRC asides to be flushed into the transcript during disposal instead of being discarded
• Fixed interactive submissions made while the TUI had no active input waiter: they now start a real prompt directly, with steer fallback if a background turn races in, instead of queueing behind a non-resumable idle transcript and appearing to do nothing.
• Fixed pressing Esc (or Alt+Up dequeue) while agent-authored messages were queued — advisor concern/blocker notes, hidden goal/plan/budget steers, IRC/extension asides — dumping their text into the user's editor. Editor restoration (clearQueue()), pending chips (getQueuedMessages()), and popLastQueuedMessage() now surface only genuinely user-authored queued messages (plain user turns and attribution: "user" custom messages like /skill). Plain Alt+Up dequeue leaves all other queued messages in place for the continuing stream; only the Esc interrupt path keeps just advisor cards (so abort's preservation still re-records them as visible advice) and drops other internal steers, so a user interrupt can't be silently undone by an auto-resume on leftover internal context. queuedMessageCount still reflects all actual queued work (advisor cards included) so hasPendingMessages()/RPC and the empty-submit abort gate stay accurate.
• Fixed advisor concern/blocker advice being withheld from the running agent and then dumped as one burst at the next user prompt after a deliberate interrupt. A user interrupt latches advisor auto-resume suppression, but a non-user resume (synthetic/auto-continue, or a queued steer draining after the abort) leaves the run streaming with that latch still set, so every interrupting note was parked hidden in the next-turn queue instead of steered into the live turn — the agent never heard the advisor mid-run and the backlog flushed all at once on the next prompt. Suppression now only withholds interrupting advice while the agent is idle (or still tearing the interrupted turn down); once a turn is streaming again the note is steered in live, since steering an active run never auto-resumes a stopped one. A concern that strands in the steer queue past the resumed turn's final poll is reclaimed as visible advice when the agent settles (mirroring abort), so it neither auto-resumes the stopped run nor lingers to flush at the next prompt.
• Fixed omp --continue/-c sometimes resuming into a subagent transcript instead of the interactive session. Subagent (and HTML-export) SessionManager.open() calls run in the parent's terminal and were clobbering the per-TTY --continue breadcrumb with their own artifact-dir session file; these headless opens now suppress the breadcrumb. continueRecent() also recovers already-poisoned breadcrumbs by resolving any session file inside a parent's artifacts dir (<parent>/<agentId>.jsonl) back up to the top-level session.
• Fixed the Agent Hub stacking duplicate Agent Hub · N running frames and stranding garbage rows in scrollback while navigating with subagents still streaming. The hub was a non-fullscreen overlay composited over a live transcript, so each time a running subagent's progress grew the frame and scrolled the window the previously-painted hub copy was pushed permanently into the terminal's native scrollback (which the engine can't rewrite). It now renders inline in the editor slot — the same anchored region every other selector and the ask tool use — riding the normal append-only commit path, so the transcript commits above it exactly once and the hub repaints in place instead of leaking copies. (Avoids borrowing the alternate screen.)
• Fixed every subagent registering itself as its own parent in the agent registry (parentId === id), so the Agent Hub rendered each agent as sub · of <itself> and the ←← parent-navigation gesture looped on the same agent. The SDK was reusing parentTaskPrefix — the agent's own artifact/output-id prefix — as the registry parent link; spawns now pass a separate parentAgentId (the spawning agent's id: Main for top-level task spawns, the parent subagent for nested spawns and eval agent(), the focused agent for /tan) and the registry records that as the parent.
• Fixed messaging a parked subagent that was restored from disk (Agent Hub scan, or a resumed/restarted session) failing with cannot be revived (no reviver registered) even though its transcript was intact. Such refs carry a session file but no in-memory reviver — the executor's live reviver closure dies with the spawning turn/process — so IRC sends and Agent Hub focus refused them. AgentLifecycleManager.ensureLive now cold-revives them through a persisted-subagent reviver factory (installed by the top-level interactive/RPC session) that rebuilds the subagent from its JSONL the way --resume rebuilds a session: it reopens the file and replays it through createAgentSession, but sources the runtime contract from a now-readable session_init record (SessionManager.peekSessionInit) so tools, system prompt, output schema, and kind are restored rather than resurrected as a default top-level session. session_init now also persists the effective spawns allowlist and read-summarization flag so a cold revive keeps the original capability surface (old files without them deny re-spawning rather than defaulting to wildcard). Isolated runs and pre-session_init files whose recorded workspace no longer exists stay transcript-only (history://).
• Fixed the terminal window-title OSC writes (setTerminalTitle/pushTerminalTitle/popTerminalTitle) leaking escape sequences to a developer's terminal during bun test; they now skip when the terminal is headless (the test-runtime default), matching the ProcessTerminal render/probe suppression so interactive-mode tests no longer paint to the real terminal
• Fixed empty CLI sessions being retained after opening omp and exiting without a prompt (#2800).
• Fixed hooks/pre/*.ts and hooks/post/*.ts files discovered through hookCapability being registered in discovery but never loaded into the extension runner, so their tool_call handlers now run without a manual settings.json extensions entry (#2796).
• Fixed startup model fallback choosing the plain OpenAI gpt-5.5 provider before the Codex OAuth provider when both shared the same default model id, which could surface a misleading OpenAI 401 despite valid Codex credentials (#2807).
• Fixed local auto-thinking classification for reasoning-capable tiny models by giving them the same safe answer budget as online reasoning classifiers, with a larger local floor for non-reasoning tiny models (#2808).

Removed

• Removed the built-in render_mermaid tool and its renderMermaid.enabled setting, so it can no longer be invoked directly

@oh-my-pi/collab-web

Removed

• Removed rendering support for the render_mermaid tool from the web tool registry

@oh-my-pi/pi-tui

Added

• Added \tfrac support to stacked display-math rendering so it now displays as a vertical fraction in latexToBlock output
• Added markdown parsing for own-line display-math blocks ($$...$$ and \[...\]) and delimiter-free \begin{...}...\end{...} math environments so block equations render via LaTeX-to-Unicode
• Added stacked rendering of display-math fractions (\frac, \dfrac, \cfrac): the numerator is drawn over a horizontal bar over the denominator, with surrounding terms and align/equation-style environment rows aligned to the bar. Triggered for own-line $$/\[ blocks, bare \begin{...} environments, and a paragraph whose sole content is a single display-math span; inline $...$ fractions stay single-line (½, (a+b)/c)
• Added bare math auto-rendering in renderMathInText for math-shaped lines and math environment blocks that omit $/\( delimiters
• Added LaTeX-to-Unicode rendering for markdown math spans, converting $$...$$, $...$, \(...\), and \[...\] into readable Unicode in Markdown output
• Exported LaTeX conversion helpers from the package entrypoint so consumers can call latexToUnicode, latexToBlock, renderMathInText, inlineMathSpanEnd, and isBareMathEnvironment directly
• Expanded LaTeX-to-Unicode conversion coverage for additional math fonts, delimiters, extensible arrows, layout environments, cancel/brace annotations, references, and AMS symbols
• Added ANSI color rendering for LaTeX \textcolor, scoped \color, \colorbox, and \fcolorbox, including xcolor/CSS color parsing and truecolor/256-color terminal output
• Added an optional maxWidth parameter to MarkdownTheme.resolveMermaidAscii to allow diagram resolvers to fit ASCII output to the available content width

Changed

• Changed markdown math rendering to preserve multiline layout for display equations, keeping \\ row breaks as separate output lines (including inside list items)

Fixed

• Fixed alignat/alignedat/gatheredat rendering in latexToBlock so the required {n} preamble is not rendered as visible math content
• Fixed math parsing to leave non-math LaTeX snippets (for example \begin{itemize}) and fenced code blocks as literal text instead of rendering them as math
• Fixed renderInlineMarkdown to handle top-level display-math tokens so raw $$...$$ delimiters are no longer leaked
• Fixed inline math span detection so escaped dollars and currency-like patterns (such as $5 and $10) are not converted as math
• Fixed Mermaid diagram rendering in Markdown code blocks to clip each ASCII line to content width before wrapping, preventing preformatted diagram rows from fragmenting
• Fixed fullscreen overlays losing keyboard focus to hidden prompt surfaces, which could make settings unresponsive while a background approval request was pending (#2789).
• Fixed bun test runs inside a real terminal leaking TUI output: ProcessTerminal now honors a headless test-runtime default, so frame paints, start() capability probes (OSC 11 / DA1 / kitty), the progress keepalive, notifications, and teardown escapes no longer reach the developer's terminal, and stdin raw mode is never engaged. Previously #safeWrite only skipped on !process.stdout.isTTY, so a developer running the suite in an interactive terminal saw stray status/editor boxes and probe queries. Terminal-contract suites opt back into real I/O via setTerminalHeadless(false)

@oh-my-pi/pi-utils

Added

• Added escapeXmlText utility to escape XML-significant characters &, <, and > in element body text
• Added isTerminalHeadless() / setTerminalHeadless() to centrally suppress real-terminal side effects (stdout escape/frame writes, stdin raw mode, CSI/OSC capability probes, SIGWINCH, window-title changes, emergency restore) under the test runtime. Defaults on when bun test sets NODE_ENV=test; terminal-contract tests opt out via setTerminalHeadless(false)

What's Changed

• fix(tui): keep overlay focus above hidden prompts by @roboomp in #2795
• fix(coding-agent): load discovered hook factories by @roboomp in #2798
• fix(cli): skip empty session persistence by @roboomp in #2804
• fix(coding-agent): prefer Codex default auth by @roboomp in #2810
• fix(coding-agent): expand local auto-thinking classifier budget by @roboomp in #2814

Full Changelog: v16.0.2...v16.0.3

Transforming Threat Data into High-Confidence Intelligence

In an era of relentless and complex cyber attacks, traditional, manual threat intelligence cannot keep pace. Security teams are overwhelmed by data fragmentation and the critical lack of context. “The Intelligent Shield” introduces a new paradigm: beyond simply ingesting data, it’s about deploying advanced, automated machine learning pipelines for AI-driven enrichment.

This guide demonstrates how to integrate state-of-the-art Large Language Models (LLMs), such as Claude AI, into an OpenCTI ecosystem. By leveraging the OpenCTI STIX 2.1 Knowledge Graph and natural language processing, this architecture converts disparate, unstructured data feeds into high-fidelity, actionable intelligence. It automatically builds context, executes deep mapping to frameworks like the MITRE ATT&CK Matrix, and generates calculated, real-time Confidence Scores, enabling organizations to proactively strengthen their defenses with an intuitive, automated Intelligent Shield.

Table of Contents

1. What is OpenCTI?
2. Core Capabilities
3. Architecture Overview
4. Threat Intelligence Feeds
5. AI Integration Layer
6. Prerequisites
7. Docker Compose Deployment
8. Connector Configuration
9. AI-Driven Enrichment Pipeline
10. Post-Deployment Hardening
11. Operational Runbook
12. Troubleshooting
13. Usage Examples

1. What is OpenCTI?

OpenCTI (Open Cyber Threat Intelligence) is an open-source platform developed by Filigran (formerly a project of ANSSI, the French national cybersecurity agency) for structuring, storing, organizing, visualizing, and sharing cyber threat intelligence (CTI).

It implements the STIX 2.1 (Structured Threat Information eXpression) standard as its native data model and exposes a GraphQL API for all read/write operations. Every object — threat actors, campaigns, malware, vulnerabilities, indicators, attack patterns — is stored as a STIX Domain Object (SDO) or STIX Relationship Object (SRO) backed by two databases:

• ElasticSearch / OpenSearch — full-text search and analytics
• Apache Cassandra (via JanusGraph) — graph relationship storage

Why OpenCTI?

2. Core Capabilities

2.1 Knowledge Graph

• Entities: Threat Actors, Intrusion Sets, Campaigns, Malware, Tools, Vulnerabilities (CVE), Attack Patterns (MITRE ATT&CK), Courses of Action, Sectors, Countries, Organizations
• Relationships modelled as first-class STIX SROs with confidence scores, date ranges, and TLP markings
• Diamond Model and Kill Chain views built in

2.2 Indicator Management

• IOC lifecycle: valid_from / valid_until with automatic expiry
• Detection rule generation (Sigma, YARA, Snort)
• Bulk import via STIX, CSV, OpenIOC, MISP formats
• Scoring and confidence weighting per source

2.3 MITRE ATT&CK Navigator Integration

• Full ATT&CK Enterprise / Mobile / ICS matrices
• Heatmaps of technique usage per threat actor or campaign
• Gap analysis against your current detection coverage

2.4 Threat Actor Profiling

• Attributed aliases, motivations (financial, espionage, hacktivism)
• Geo and sector targeting mapped on world map
• Timeline of campaigns and malware usage

2.5 Automation & Playbooks

• Built-in playbook engine (since v5.9): trigger enrichment, notifications, or SOAR actions on entity creation/modification(Enterprise Edition only)
• Python SDK for custom automation
• Webhook support for external integrations

2.6 Collaboration & Sharing

• Role-based access control (RBAC) with groups and organizations
• TLP (Traffic Light Protocol) enforcement at object level
• TAXII 2.1 server — push feeds to SIEMs, firewalls, EDR platforms
• Sharing with partner organizations via federated instances

2.7 Dashboard & Reporting

• Customizable dashboards with widget library
• PDF report generation
• Timeline, matrix, and entity views
• Attack path visualization

3. Architecture Overview

4. Threat Intelligence Feeds

4.1 Free / Open-Source Feeds

• MITRE ATT&CK — Connector: opencti/connector-mitre — Data: Techniques, mitigations, groups, software — Setup: API key not needed.
• CVE / NVD — Connector: opencti/connector-cve — Data: Vulnerabilities — Setup: NVD API key recommended/required depending on configuration.
• AlienVault OTX — Connector: opencti/connector-alienvault — Data: IOCs, pulses, malware families — Setup: Free OTX account/API key.
• Abuse.ch MalwareBazaar — Connector: opencti/connector-malwarebazaar — Data: Malware hashes, malware metadata, file observables — Setup: Free MalwareBazaar API key.
• Abuse.ch URLhaus — Connector: opencti/connector-urlhaus — Data: Malicious URLs — Setup: Public feed; no API key for CSV feed.
• Abuse.ch Feodo Tracker — Connector: use opencti/connector-misp-feed or ingest the Feodo CSV/blocklist feed manually — Data: Botnet C2 IPs — Setup: Free.
• Shodan InternetDB — Connector: opencti/connector-shodan-internetdb — Data: IP enrichment, domains, CPEs, CVEs, tags — Setup: No API key required.
• MISP Default / CIRCL OSINT Feeds — Connector: opencti/connector-misp-feed — Data: STIX/MISP bundles, indicators, observables — Setup: Free.
• CyberCrime-Tracker feed via MISP default feeds — Connector: use opencti/connector-misp-feed rather than a dedicated current connector — Data: C2 panels / freetext indicators — Setup: Free.
• OpenPhish — Connector: no verified current dedicated OpenCTI connector in the main repo; use generic feed ingestion where suitable — Data: Phishing URLs — Setup: Free/community feed options.
• DigitalSide IT-ISAC MISP Feed — Connector: opencti/connector-misp-feed with custom MISP_FEED_URL — Data: IOCs / MISP-format feed — Setup: Free.

4.2 Commercial Feeds (require license/API key)

• MISP — self-hosted — Connector: opencti/connector-misp — Strengths: community sharing, custom events, internal/private CTI exchange. The OpenCTI repo lists both misp and misp-feed; use misp for a live MISP instance with API access, and misp-feed for static MISP feed URLs.
• VirusTotal / Google Threat Intelligence — Connector: opencti/connector-virustotal — Strengths: file, URL, domain, and IP enrichment. The connector is under internal-enrichment, not external-import.
• Mandiant Threat Intelligence / Google Threat Intelligence — Connector: opencti/connector-mandiant — Strengths: APT intelligence, actor reporting, malware/campaign context.
• Recorded Future — Connectors: opencti/connector-recordedfuture and opencti/connector-recordedfuture-enrichment — Strengths: risk lists, enrichment, vulnerability/contextual intelligence, dark web and external threat data. Recorded Future documentation describes the OpenCTI integration as two components: an enrichment connector and a Recorded Future connector.
• CrowdStrike Falcon Intelligence — Connector: opencti/connector-crowdstrike — Strengths: actor tracking, indicators, adversary intelligence, Falcon ecosystem context.
• Sekoia.io Intelligence — Connector: opencti/connector-sekoia — Strengths: European threat landscape, CTI feed ingestion, actor/campaign context. Sekoia’s own documentation points to the OpenCTI GitHub connector path.
• ThreatConnect — Connector: no verified current dedicated connector in the main OpenCTI connector tree — Strengths: enterprise TI management, source aggregation, workflow and case management. I found an OpenCTI GitHub label/feature reference for “threat connect,” but not a confirmed current connector folder equivalent to external-import/threatconnect.
• Intel 471 — Connectors: opencti/connector-intel471, opencti/connector-intel471-darknet, and opencti/connector-intel471_v2 — Strengths: underground forums, cybercrime actors, malware, infrastructure, dark web intelligence.

4.3 ISAC / Government Feeds

• CISA Automated Indicator Sharing / AIS — Method: TAXII/STIX client, AIS 2.0 uses TAXII 2.1 — Access: free service for eligible participants; contact CISA to onboard.
• FS-ISAC — Method: STIX/TAXII and MISP automated feeds — Access: financial-sector membership; automated-feed credentials/licensing must be explicitly requested.
• Health-ISAC / H-ISAC — Method: HITS indicator-sharing feed; STIX/TAXII-compatible threat intelligence sharing — Access: healthcare-sector membership / Health-ISAC member access.
• NATO MISP Community — Method: MISP community / MISP sync — Access: official government cyber-defense entities from NATO nations, sponsored by their national representative in the NATO Multinational MISP Steering Board.
• ENISA Threat Landscape — Method: public reports and CTI publications; not a confirmed public TAXII/STIX feed. ENISA’s CTL methodology references STIX 2.1 as a common CTI representation format, but this is different from offering a public feed endpoint.

4.4 Feed Priority and TLP Assignment

# Recommended TLP assignment by source
feeds:
  - source: mitre_attack
    tlp: WHITE          # public, shareable
    confidence: 90
  - source: alienvault_otx
    tlp: GREEN          # community sharing
    confidence: 60
  - source: mandiant
    tlp: AMBER          # restricted to org
    confidence: 85
  - source: internal_soc
    tlp: RED            # internal only
    confidence: 95

5. AI Integration Layer

This is the “AI-driven” layer on top of standard OpenCTI — a custom connector and MCP server that adds:

5.1 AI Enrichment Connector (Claude API)

• On every new Report, Malware, or Threat-Actor ingested → call Claude API
• Extract structured STIX entities from unstructured text (PDFs, blog posts)
• Summarize long reports into 3-sentence executive briefs
• Score indicator relevance against your organization’s sector profile
• Suggest ATT&CK technique mappings from narrative descriptions

5.2 AI Pipeline Architecture

New Report ingested
        │
        ▼
[AI Enrichment Connector]
        │
        ├─► Claude API: Extract entities → creates STIX SDOs
        ├─► Claude API: Map to ATT&CK techniques
        ├─► Claude API: Generate executive summary
        └─► Claude API: Score severity for your sector
                │
                ▼
        Update Report in OpenCTI
        (summary, related entities, confidence scores)

6. Prerequisites

6.1 Hardware (minimum production)

6.2 Software

# Install Docker Engine (Ubuntu 22.04)
sudo apt-get update
sudo apt-get install -y ca-certificates curl gnupg lsb-release
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
  sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
# Add user to docker group
sudo usermod -aG docker $USER
newgrp docker
# Verify
docker compose version

6.3 System Tuning (required for ElasticSearch)

# ElasticSearch requires high vm.max_map_count
sudo sysctl -w vm.max_map_count=1048575
echo "vm.max_map_count=1048575" | sudo tee -a /etc/sysctl.conf

# Increase file descriptor limits
echo "* soft nofile 65536" | sudo tee -a /etc/security/limits.conf
echo "* hard nofile 65536" | sudo tee -a /etc/security/limits.conf

7. Docker Compose Deployment

7.0 Deploy from GitHub (recommended)

The fastest deployment path is to clone the maintained project repository and create a local `.env` from the sanitized template:

cd /home/andrey
git clone https://github.com/anpa1200/opencti-intelligent-shield.git openCTI
cd /home/andrey/openCTI
# Create local secrets/config. This file is ignored by Git.
cp .env.example .env
nano .env
# Start the full stack after filling in .env
./scripts/start-all.sh

This gives you the Docker Compose files, OpenCTI patches, AI enrichment connector, helper scripts, and Docusaurus documentation in one checkout. Use the manual sections below if you want to recreate the files by hand or compare the generated content.

7.1 Directory Structure

/home/andrey/openCTI/
├── .env                          # secrets and config
├── docker-compose.yml            # core stack
├── docker-compose.connectors.yml # feed connectors
├── docker-compose.ai.yml         # AI enrichment connector
├── patches/
│   └── back.js                   # ILM race condition fix (ES 8.13 + OpenCTI 6.2.0)
└── connectors/
    └── ai-enrichment/            # custom AI connector source

7.2 Environment File

cat > /home/andrey/openCTI/.env << 'EOF'
# === Core ===
OPENCTI_ADMIN_EMAIL=admin@opencti.local
OPENCTI_ADMIN_PASSWORD=CHANGE_ME_STRONG_PASSWORD
OPENCTI_ADMIN_TOKEN=CHANGE_ME_UUID4_TOKEN
OPENCTI_BASE_URL=http://localhost:8080

# === Secrets ===
APP__ADMIN__TOKEN=CHANGE_ME_UUID4_TOKEN
APP__SECRET_KEY=CHANGE_ME_SECRET

# === ElasticSearch ===
# NOTE: key is ELASTIC_PASSWORD, not ELASTIC_AUTH
ELASTIC_PASSWORD=CHANGE_ME_ELASTIC_PASS

# === Redis ===
REDIS_PASSWORD=opencti

# === MinIO ===
MINIO_ROOT_USER=opencti
MINIO_ROOT_PASSWORD=CHANGE_ME_MINIO_PASS

# === RabbitMQ ===
RABBITMQ_DEFAULT_USER=opencti
RABBITMQ_DEFAULT_PASS=CHANGE_ME_RABBITMQ_PASS

# === Connector IDs (unique UUID4 per connector — NOT used for auth) ===
CONNECTOR_MITRE_TOKEN=CHANGE_ME_UUID4
CONNECTOR_CVE_TOKEN=CHANGE_ME_UUID4
CONNECTOR_ALIENVAULT_TOKEN=CHANGE_ME_UUID4
CONNECTOR_ABUSE_SSL_TOKEN=CHANGE_ME_UUID4
CONNECTOR_URLHAUS_TOKEN=CHANGE_ME_UUID4
CONNECTOR_AI_ENRICHMENT_TOKEN=CHANGE_ME_UUID4

# === External API keys ===
ALIENVAULT_API_KEY=your_otx_key_here
NVD_API_KEY=your_nvd_api_key_here     # UUID format from nvd.nist.gov/developers/request-an-api-key
ANTHROPIC_API_KEY=your_claude_api_key_here
EOF

# Generate unique UUIDs for connector IDs
python3 -c "import uuid; [print(uuid.uuid4()) for _ in range(8)]"# Generate proper tokens
python3 -c "import uuid; [print(f'Token: {uuid.uuid4()}') for _ in range(10)]"

7.3 Core Stack — docker-compose.yml

nano docker-compose.yml

version: "3"
services:
  redis:
    image: redis:7.2
    restart: always
    volumes:
      - redisdata:/data
    command: redis-server --requirepass ${REDIS_PASSWORD:-opencti}
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.13.0
    volumes:
      - esdata:/usr/share/elasticsearch/data
    environment:
      - discovery.type=single-node
      - xpack.ml.enabled=false
      - xpack.security.enabled=true
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD:-CHANGE_ME}
      - "ES_JAVA_OPTS=-Xms2g -Xmx2g"
      - cluster.routing.allocation.disk.threshold_enabled=false
    ulimits:
      memlock:
        soft: -1
        hard: -1
    restart: always
  minio:
    image: minio/minio:RELEASE.2024-01-16T16-07-38Z
    volumes:
      - miniodata:/data
    ports:
      - "9001:9001"   # console
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-opencti}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-CHANGE_ME}
    command: server /data --console-address ":9001"
    restart: always
  rabbitmq:
    image: rabbitmq:3.13-management
    environment:
      RABBITMQ_DEFAULT_USER: ${RABBITMQ_DEFAULT_USER:-opencti}
      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS:-CHANGE_ME}
      RABBITMQ_NODENAME: rabbit01@localhost
    volumes:
      - rabbitmqdata:/var/lib/rabbitmq
    restart: always
  opencti:
    image: opencti/platform:6.2.0
    environment:
      NODE_OPTIONS: --max-old-space-size=8096
      APP__PORT: 8080
      APP__BASE_URL: ${OPENCTI_BASE_URL:-http://localhost:8080}
      APP__ADMIN__EMAIL: ${OPENCTI_ADMIN_EMAIL}
      APP__ADMIN__PASSWORD: ${OPENCTI_ADMIN_PASSWORD}
      APP__ADMIN__TOKEN: ${OPENCTI_ADMIN_TOKEN}
      APP__APP_LOGS__LOGS_LEVEL: error
      REDIS__HOSTNAME: redis
      REDIS__PORT: 6379
      REDIS__USE_SSL: "false"
      REDIS__PASSWORD: ${REDIS_PASSWORD:-opencti}
      ELASTICSEARCH__URL: http://elasticsearch:9200
      ELASTICSEARCH__USERNAME: elastic
      ELASTICSEARCH__PASSWORD: ${ELASTIC_PASSWORD:-CHANGE_ME}
      MINIO__ENDPOINT: minio
      MINIO__PORT: 9000
      MINIO__USE_SSL: "false"
      MINIO__ACCESS_KEY: ${MINIO_ROOT_USER:-opencti}
      MINIO__SECRET_KEY: ${MINIO_ROOT_PASSWORD:-CHANGE_ME}
      RABBITMQ__HOSTNAME: rabbitmq
      RABBITMQ__PORT: 5672
      RABBITMQ__USERNAME: ${RABBITMQ_DEFAULT_USER:-opencti}
      RABBITMQ__PASSWORD: ${RABBITMQ_DEFAULT_PASS:-CHANGE_ME}
      SMTP__HOSTNAME: localhost
      PROVIDERS__LOCAL__STRATEGY: LocalStrategy
    volumes:
      - ./patches/back.js:/opt/opencti/build/back.js:ro
    ports:
      - "8080:8080"
    depends_on:
      - redis
      - elasticsearch
      - minio
      - rabbitmq
    restart: always
  worker:
    image: opencti/worker:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      WORKER_LOG_LEVEL: error
    depends_on:
      - opencti
    deploy:
      mode: replicated
      replicas: 3
    restart: always
volumes:
  esdata:
  redisdata:
  miniodata:
  rabbitmqdata:
networks:
  default:
    name: opencti_network
    external: true

7.4 Connectors — docker-compose.connectors.yml

nano docker-compose.connectors.yml

version: "3"
services:
  # MITRE ATT&CK (no API key needed)
  connector-mitre:
    image: opencti/connector-mitre:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_MITRE_TOKEN}
      CONNECTOR_NAME: "MITRE ATT&CK"
      CONNECTOR_SCOPE: "marking-definition,identity,attack-pattern,course-of-action,intrusion-set,campaign,malware,tool,vulnerability,x-mitre-matrix,x-mitre-tactic,x-mitre-collection"
      CONNECTOR_CONFIDENCE_LEVEL: 75
      CONNECTOR_UPDATE_EXISTING_DATA: "true"
      CONNECTOR_LOG_LEVEL: error
      MITRE_REMOVE_STATEMENT_MARKING: "true"
      MITRE_INTERVAL: 7  # days between full refresh
    restart: always
  # CVE / NVD Vulnerabilities
  connector-cve:
    image: opencti/connector-cve:6.2.0
    volumes:
      - ./patches/cve/api.py:/opt/opencti-connector-cve/services/client/api.py:ro
      - ./patches/cve/vulnerability.py:/opt/opencti-connector-cve/services/client/vulnerability.py:ro
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_CVE_TOKEN}
      CONNECTOR_NAME: "Common Vulnerabilities and Exposures"
      CONNECTOR_SCOPE: "identity,vulnerability"
      CONNECTOR_CONFIDENCE_LEVEL: 75
      CONNECTOR_LOG_LEVEL: info
      CONNECTOR_UPDATE_EXISTING_DATA: "true"
      CVE_BASE_URL: "https://services.nvd.nist.gov/rest/json/cves"
      CVE_API_KEY: ${NVD_API_KEY}
      CVE_MAX_DATE_RANGE: 120
      CVE_MAINTAIN_DATA: "true"
      CVE_INTERVAL: 2
    restart: always
  # AlienVault OTX
  connector-alienvault:
    image: opencti/connector-alienvault:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_ALIENVAULT_TOKEN}
      CONNECTOR_NAME: "AlienVault OTX"
      CONNECTOR_SCOPE: "stix-core-object"
      CONNECTOR_CONFIDENCE_LEVEL: 40
      CONNECTOR_LOG_LEVEL: error
      ALIENVAULT_BASE_URL: "https://otx.alienvault.com"
      ALIENVAULT_API_KEY: ${ALIENVAULT_API_KEY}
      ALIENVAULT_TLP: "White"
      ALIENVAULT_CREATE_OBSERVABLES: "true"
      ALIENVAULT_CREATE_INDICATORS: "true"
      ALIENVAULT_PULSE_START_TIMESTAMP: "2020-01-01T00:00:00"
      ALIENVAULT_REPORT_STATUS: "New"
      ALIENVAULT_REPORT_TYPE: "threat-report"
      ALIENVAULT_GUESS_MALWARE: "false"
      ALIENVAULT_GUESS_CVE: "false"
      ALIENVAULT_INTERVAL: 30   # minutes
    restart: always
  # Abuse.ch SSL Blacklist
  connector-abuse-ssl:
    image: opencti/connector-abuse-ssl:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_MALWAREBAZAAR_TOKEN}
      CONNECTOR_NAME: "Abuse.ch SSL Blacklist"
      CONNECTOR_SCOPE: "stix-core-object"
      CONNECTOR_CONFIDENCE_LEVEL: 50
      CONNECTOR_LOG_LEVEL: error
      ABUSE_SSL_URL: "https://sslbl.abuse.ch/blacklist/sslblacklist.csv"
      ABUSE_SSL_INTERVAL: 30  # minutes
    restart: always
  # Abuse.ch URLhaus
  connector-urlhaus:
    image: opencti/connector-urlhaus:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_URLHAUS_TOKEN}
      CONNECTOR_NAME: "Abuse.ch URLhaus"
      CONNECTOR_SCOPE: "stix-core-object"
      CONNECTOR_CONFIDENCE_LEVEL: 40
      CONNECTOR_LOG_LEVEL: error
      URLHAUS_CSV_URL: "https://urlhaus.abuse.ch/downloads/csv_recent/"
      URLHAUS_IMPORT_OFFLINE: "true"
      URLHAUS_INTERVAL: 2  # hours
    restart: always
  connector-threatfox:
    image: opencti/connector-threatfox:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_THREATFOX_TOKEN}
      CONNECTOR_NAME: "ThreatFox"
      CONNECTOR_SCOPE: "stix-core-object"
      CONNECTOR_CONFIDENCE_LEVEL: 40
      CONNECTOR_LOG_LEVEL: error
      THREATFOX_API_URL: "https://threatfox-api.abuse.ch/api/v1/"
      THREATFOX_CREATE_INDICATORS: "true"
      THREATFOX_CREATE_OBSERVABLES: "true"
      THREATFOX_INTERVAL: 3
    restart: always
  connector-import-document:
    image: opencti/connector-import-document:6.2.0
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_IMPORT_DOCUMENT_TOKEN}
      CONNECTOR_NAME: "ImportDocument"
      CONNECTOR_SCOPE: "application/pdf,text/plain,text/html"
      CONNECTOR_AUTO: "true"
      CONNECTOR_CONFIDENCE_LEVEL: 75
      CONNECTOR_LOG_LEVEL: error
    restart: always
networks:
  default:
    name: opencti_network
    external: true

7.5 AI Enrichment Connector — docker-compose.ai.yml

nano docker-compose.ai.yml

version: "3"

services:
  connector-ai-enrichment:
    build:
      context: ./connectors/ai-enrichment
      dockerfile: Dockerfile
    environment:
      OPENCTI_URL: http://opencti:8080
      OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}
      CONNECTOR_ID: ${CONNECTOR_AI_ENRICHMENT_TOKEN}
      CONNECTOR_NAME: "AI Enrichment (Claude)"
      CONNECTOR_LOG_LEVEL: info
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY}
      AI_MODEL: claude-opus-4-7
      AI_ENRICHMENT_REPORTS: "true"
      AI_ENRICHMENT_MALWARE: "true"
      AI_ENRICHMENT_THREAT_ACTORS: "true"
    restart: always

networks:
  default:
    name: opencti_network
    external: true

8. Connector Configuration

Fast Start / Stop Scripts

The repository includes two helper scripts for daily operations:

# Start core OpenCTI, wait for the UI/API, then start connectors and AI enrichment
./scripts/start-all.sh
# Stop AI enrichment, connectors, and core OpenCTI while preserving Docker volumes
./scripts/stop-all.sh

Use these scripts for normal start/stop operations after .env is configured. Use the manual commands below when debugging a specific service startup problem.

nano start-all.sh

#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT_DIR"

WAIT_TIMEOUT="${WAIT_TIMEOUT:-300}"

wait_for_opencti() {
  local deadline=$((SECONDS + WAIT_TIMEOUT))

  echo "[start] Waiting for OpenCTI API on http://localhost:8080..."
  until curl -fsS http://localhost:8080 >/dev/null 2>&1; do
    if (( SECONDS >= deadline )); then
      echo "[start] OpenCTI did not become reachable within ${WAIT_TIMEOUT}s." >&2
      echo "[start] Check logs with: docker compose logs -f opencti" >&2
      return 1
    fi
    sleep 5
  done
}

echo "[start] Starting OpenCTI core stack..."
docker compose -f docker-compose.yml up -d

wait_for_opencti

echo "[start] Starting external connectors..."
docker compose -f docker-compose.connectors.yml up -d

echo "[start] Building and starting AI enrichment connector..."
docker compose -f docker-compose.ai.yml up -d --build

echo "[start] Done."
docker compose -f docker-compose.yml ps

nano stop-all.sh

#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT_DIR"

echo "[stop] Stopping OpenCTI core, connectors, and AI enrichment..."
docker compose \
  -f docker-compose.yml \
  -f docker-compose.connectors.yml \
  -f docker-compose.ai.yml \
  down --remove-orphans

echo "[stop] Done. Volumes are preserved."

8.1 Start the Core Stack

cd /home/andrey/openCTI

# Pre-flight: ElasticSearch refuses allocation above 90% disk usage
df -h /var/lib/docker
# If > 90% full, run: docker system prune -a   (frees ~47 GB of unused images)

# Create the shared Docker network (idempotent — safe to re-run)
docker network create opencti_network 2>/dev/null || true

# Start core services
docker compose -f docker-compose.yml up -d

# Wait for ElasticSearch to be healthy before OpenCTI finishes initializing
until curl -s -u "elastic:${ELASTIC_PASSWORD}" \
  http://localhost:9200/_cluster/health | grep -q '"status":"green"\|"status":"yellow"'; do
  echo "Waiting for ES..."; sleep 5
done

# Watch logs — first-run index creation takes 5-10 minutes
# Look for "Listening on port 8080"
docker compose -f docker-compose.yml logs -f opencti | grep -E "Listening|ERROR|indices"

8.2 Start Connectors

# Start feed connectors (after OpenCTI is healthy)
docker compose -f docker-compose.connectors.yml up -d
# Verify connectors registered (wait ~60s for startup)
docker compose -f docker-compose.connectors.yml ps

8.3 Verify in UI

http://localhost:8080
Login: admin@opencti.local / <your password>Navigation:
  Data → Connectors → check all show status "connected"
  Knowledge → Malwares → should start populating within minutes
  Activities → Logs → watch ingest events

9. AI-Driven Enrichment Pipeline

Overview

The AI enrichment pipeline adds a Claude-powered layer on top of the standard OpenCTI ingestion flow. Every time a connector (AlienVault, MITRE, URLhaus, etc.) writes a new object into OpenCTI, an event is published to RabbitMQ. The AI connector subscribes to that event stream, calls the Claude API with the object’s content, and writes the extracted structured intelligence back into the graph as STIX relationships, notes, and entity updates — all automatically.

Without AI enrichment:

AlienVault pulse → Report object in OpenCTI
                   (raw text, no relationships, no ATT&CK mapping)

With AI enrichment:

AlienVault pulse → Report object in OpenCTI
                       ↓ AI connector picks it up from event stream
                   Claude API: extract entities, map techniques, score severity
                       ↓
                   Report now has:
                   ├── Note: executive summary (2-3 sentences)
                   ├── Relationship → ThreatActor (if found in graph)
                   ├── Relationship → Malware (if found in graph)
                   ├── Relationship → AttackPattern T1059.001 (created if missing)
                   └── x_opencti_score updated based on AI confidence

9.1 How the Event Stream Works

OpenCTI uses RabbitMQ as its internal message bus. Every write operation (create, update, delete) on any STIX object publishes a message to a topic exchange. Connectors subscribe to this exchange via pycti's OpenCTIConnectorHelper.listen() method.

OpenCTI platform
      │
      │ write event (STIX bundle)
      ▼
  RabbitMQ
  exchange: amq.topic
      │
      ├──► worker-1 (standard workers — write to ES/graph)
      ├──► worker-2
      ├──► worker-3
      └──► connector-ai-enrichment  ← our connector subscribes here
                  │
                  │ reads event payload:
                  │ {
                  │   "type": "create",
                  │   "data": { "id": "report--uuid", "type": "report", ... }
                  │ }
                  ▼
            calls Claude API
                  ▼
            writes enrichment back via GraphQL API

Each message contains the full STIX object that was just created. The connector processes it and acknowledges the message — if it crashes mid-processing, RabbitMQ redelivers it.

Connector type INTERNAL_ENRICHMENT means:

• It does not import data on a schedule
• It reacts to existing objects as they are created or updated
• It appears in Settings → Connectors → Enrichment in the UI

9.2 Rules Engine (CE Automation)

Note: Playbooks are an Enterprise Edition feature. The Community Edition uses the built-in Rules Engine, which automatically infers and propagates relationships as data arrives.

All 20 rules are enabled. To verify or toggle: Settings → Customization → Rules

To enable all rules via API (already done — included for re-initialization):

RULES="attribution_attribution attribution_targets indicate_sighted attribution_use \
localization_of_targets location_location location_targets participate-to_parts \
observable_related observe_sighting part_part part-of_targets sighting_incident \
sighting_observable sighting_indicator report_ref_identity_part_of \
report_ref_indicator_based_on report_ref_observable_based_on \
report_ref_location_located_at parent_technique_use"
TOKEN=$(grep OPENCTI_ADMIN_TOKEN /home/andrey/openCTI/.env | cut -d= -f2)
for rule in $RULES; do
  curl -s -X POST http://localhost:8080/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"query\":\"mutation { ruleSetActivation(id: \\\"$rule\\\", enable: true) { id activated } }\"}" \
    | python3 -c "import sys,json; d=json.load(sys.stdin); print('$rule:', d['data']['ruleSetActivation']['activated'])"
done

What these rules do automatically once data arrives:

RuleEffectattribution_attributionIf APT-X is attributed to Country-A, and APT-Y is a sub-group of APT-X → APT-Y also attributed to Country-Asighting_incidentIf an indicator is sighted, automatically raise an Incidentindicate_sightedIf indicator is sighted → infer the targeted entity from the indicator's relationshipreport_ref_indicator_based_onIf a Report references Observable X, and X has an Indicator → auto-link the Indicator to the Reportobservable_relatedIf two objects share a common Observable → infer a related-to relationshipparent_technique_useIf a sub-technique (T1059.001) is used → auto-link parent technique (T1059) as used

For custom event-driven automation in CE, use a pycti script or the AI connector (section 9.1). The pycti library supports streaming the live event feed via helper.listen() — the AI connector in 9.1 uses exactly this pattern.10. Post-Deployment Hardening

9.2 What Claude Extracts and How It Maps to STIX

The connector sends the report’s description text to Claude with a structured prompt. Claude returns JSON. The connector then maps each field to STIX operations:

Claude output fieldSTIX actionsummaryCreates a Note object attached to the report (object_refs)threat_actors[]Looks up ThreatActor by name in graph → creates related-to relationship to reportmalware_families[]Looks up Malware by name → creates related-to relationship to reportattack_techniques[]Looks up AttackPattern by external_id (T1059.001) → creates uses relationship to reporttargeted_sectors[]Looks up Identity (sector) → creates targets relationshiptargeted_countries[]Looks up Location by ISO code → creates targets relationshipconfidenceSets x_opencti_score on the report (0–100)

Why look up instead of creating? MITRE ATT&CK and identity data is already loaded by the MITRE connector. Looking up prevents duplicates. Only AttackPattern objects are created if missing (since Claude may identify techniques not yet in the graph).

9.3 Connector Code

mkdir -p /home/andrey/openCTI/connectors/ai-enrichment

connectors/ai-enrichment/connector.py

import os
import json
import time
import anthropic
from pycti import OpenCTIConnectorHelper

SYSTEM_PROMPT = """You are a senior cyber threat intelligence analyst.
Analyze threat intelligence content and return structured JSON only.
No prose, no markdown fences, no explanation — raw JSON."""

REPORT_PROMPT = """Analyze this threat intelligence report. Return JSON with exactly these keys:
- summary: string (2-3 sentence executive brief, plain text)
- threat_actors: list of strings (actor names, aliases, groups mentioned)
- malware_families: list of strings (malware/tool names)
- attack_techniques: list of strings (MITRE ATT&CK IDs only, e.g. ["T1059.001", "T1003"])
- targeted_sectors: list of strings (e.g. ["Finance", "Healthcare", "Government"])
- targeted_countries: list of strings (ISO 3166-1 alpha-2, e.g. ["US", "UA", "DE"])
- confidence: integer 0-100

Report:
{content}"""

INTRUSION_SET_PROMPT = """Analyze this threat actor / intrusion set profile. Return JSON with exactly these keys:
- summary: string (2-3 sentence executive brief)
- aliases: list of strings (other known names)
- malware_families: list of strings (malware/tools this actor uses)
- attack_techniques: list of strings (MITRE ATT&CK IDs, e.g. ["T1059.001", "T1003"])
- targeted_sectors: list of strings (sectors this actor targets)
- targeted_countries: list of strings (ISO 3166-1 alpha-2 codes)
- motivation: string (one of: "espionage", "financial", "hacktivism", "destruction", "unknown")
- sophistication: string (one of: "minimal", "intermediate", "advanced", "expert", "unknown")
- confidence: integer 0-100

Profile:
{content}"""


class AIEnrichmentConnector:
    def __init__(self):
        config = {
            "opencti": {
                "url": os.environ.get("OPENCTI_URL", "http://opencti:8080"),
                "token": os.environ["OPENCTI_TOKEN"],
            },
            "connector": {
                "id": os.environ["CONNECTOR_ID"],
                "type": "INTERNAL_ENRICHMENT",
                "name": os.environ.get("CONNECTOR_NAME", "AI Enrichment (Claude)"),
                "scope": "Report,Intrusion-Set,Threat-Actor-Group,Malware",
                "log_level": os.environ.get("CONNECTOR_LOG_LEVEL", "info"),
                "auto": False,
            },
        }
        self.helper = OpenCTIConnectorHelper(config)
        self.client = anthropic.Anthropic(api_key=os.environ["ANTHROPIC_API_KEY"])
        self.model = os.environ.get("AI_MODEL", "claude-opus-4-7")

    # -------------------------------------------------------------------------
    # Claude call with retry on rate limit
    # -------------------------------------------------------------------------

    def _call_claude(self, prompt_template: str, content: str) -> dict | None:
        for attempt in range(3):
            try:
                msg = self.client.messages.create(
                    model=self.model,
                    max_tokens=2048,
                    system=SYSTEM_PROMPT,
                    messages=[{"role": "user", "content": prompt_template.format(content=content[:8000])}],
                )
                return json.loads(msg.content[0].text)
            except anthropic.RateLimitError:
                wait = 60 * (attempt + 1)
                self.helper.log_warning(f"Rate limited — waiting {wait}s")
                time.sleep(wait)
            except (json.JSONDecodeError, anthropic.APIError) as e:
                self.helper.log_error(f"Claude call failed: {e}")
                return None
        return None

    # -------------------------------------------------------------------------
    # STIX write-back helpers
    # -------------------------------------------------------------------------

    def _add_note(self, entity_id: str, summary: str, confidence: int) -> None:
        self.helper.api.note.create(
            abstract="AI Summary",
            content=summary,
            confidence=confidence,
            object_ids=[entity_id],
        )

    def _link_threat_actors(self, entity_id: str, names: list, confidence: int) -> None:
        for name in names:
            actor = self.helper.api.threat_actor_group.read(
                filters={"mode": "and", "filters": [{"key": "name", "values": [name]}], "filterGroups": []}
            )
            if actor:
                self.helper.api.stix_core_relationship.create(
                    fromId=entity_id,
                    toId=actor["id"],
                    relationship_type="related-to",
                    confidence=confidence,
                )

    def _link_malware(self, entity_id: str, names: list, confidence: int) -> None:
        for name in names:
            malware = self.helper.api.malware.read(
                filters={"mode": "and", "filters": [{"key": "name", "values": [name]}], "filterGroups": []}
            )
            if malware:
                self.helper.api.stix_core_relationship.create(
                    fromId=entity_id,
                    toId=malware["id"],
                    relationship_type="uses",
                    confidence=confidence,
                )

    def _link_attack_patterns(self, entity_id: str, technique_ids: list, confidence: int) -> None:
        for tid in technique_ids:
            pattern = self.helper.api.attack_pattern.read(
                filters={"mode": "and", "filters": [{"key": "x_mitre_id", "values": [tid]}], "filterGroups": []}
            )
            if not pattern:
                pattern = self.helper.api.attack_pattern.create(
                    name=tid,
                    x_mitre_id=tid,
                    confidence=50,
                )
            if pattern:
                self.helper.api.stix_core_relationship.create(
                    fromId=entity_id,
                    toId=pattern["id"],
                    relationship_type="uses",
                    confidence=confidence,
                )

    def _update_score(self, entity_id: str, confidence: int) -> None:
        self.helper.api.stix_domain_object.update_field(
            id=entity_id,
            input={"key": "x_opencti_score", "value": str(confidence)},
        )

    # -------------------------------------------------------------------------
    # Enrichment handlers per entity type
    # -------------------------------------------------------------------------

    def _enrich_report(self, report: dict) -> str:
        content = report.get("description") or ""
        if len(content) < 50:
            content = report.get("name", "")
        if not content or len(content) < 10:
            return "Skipped: content too short"

        self.helper.log_info(f"Enriching report: {report['name']}")
        result = self._call_claude(REPORT_PROMPT, content)
        if not result:
            return "Skipped: Claude error"

        confidence = result.get("confidence", 50)
        entity_id = report["id"]

        if result.get("summary"):
            self._add_note(entity_id, result["summary"], confidence)
        if result.get("threat_actors"):
            self._link_threat_actors(entity_id, result["threat_actors"], confidence)
        if result.get("malware_families"):
            self._link_malware(entity_id, result["malware_families"], confidence)
        if result.get("attack_techniques"):
            self._link_attack_patterns(entity_id, result["attack_techniques"], confidence)

        self._update_score(entity_id, confidence)
        self.helper.log_info(f"Enriched report '{report['name']}'")
        return "Enriched"

    def _enrich_intrusion_set(self, entity: dict) -> str:
        content = entity.get("description") or entity.get("name", "")
        if not content or len(content) < 10:
            return "Skipped: content too short"

        self.helper.log_info(f"Enriching intrusion set: {entity['name']}")
        result = self._call_claude(INTRUSION_SET_PROMPT, content)
        if not result:
            return "Skipped: Claude error"

        confidence = result.get("confidence", 50)
        entity_id = entity["id"]

        if result.get("summary"):
            self._add_note(entity_id, result["summary"], confidence)
        if result.get("malware_families"):
            self._link_malware(entity_id, result["malware_families"], confidence)
        if result.get("attack_techniques"):
            self._link_attack_patterns(entity_id, result["attack_techniques"], confidence)

        self.helper.log_info(f"Enriched intrusion set '{entity['name']}'")
        return "Enriched"

    # -------------------------------------------------------------------------
    # Event handler
    # -------------------------------------------------------------------------

    def process_message(self, data: dict) -> str:
        entity_type = data.get("entity_type", "").lower()
        entity_id = data.get("entity_id")
        enrichment_entity = data.get("enrichment_entity", {})

        self.helper.log_info(f"Received entity_type='{entity_type}' id='{entity_id}'")

        if not entity_id:
            return "Skipped"

        entity = enrichment_entity or {}

        if entity_type == "report":
            if not entity:
                entity = self.helper.api.report.read(id=entity_id) or {}
            if entity.get("confidence", 0) < 40:
                return "Skipped: low confidence"
            return self._enrich_report(entity)

        if entity_type in ("intrusion-set", "threat-actor-group"):
            if not entity:
                entity = self.helper.api.intrusion_set.read(id=entity_id) or {}
            if not entity:
                return "Not found"
            return self._enrich_intrusion_set(entity)

        if entity_type == "malware":
            if not entity:
                entity = self.helper.api.malware.read(id=entity_id) or {}
            if not entity:
                return "Not found"
            content = entity.get("description") or entity.get("name", "")
            if not content or len(content) < 10:
                return "Skipped: content too short"
            self.helper.log_info(f"Enriching malware: {entity['name']}")
            result = self._call_claude(REPORT_PROMPT, content)
            if not result:
                return "Skipped: Claude error"
            confidence = result.get("confidence", 50)
            if result.get("summary"):
                self._add_note(entity["id"], result["summary"], confidence)
            if result.get("attack_techniques"):
                self._link_attack_patterns(entity["id"], result["attack_techniques"], confidence)
            self._update_score(entity["id"], confidence)
            return "Enriched"

        return "Skipped"

    def start(self):
        self.helper.log_info("AI Enrichment connector starting...")
        self.helper.listen(self.process_message)


if __name__ == "__main__":
    AIEnrichmentConnector().start()

connectors/ai-enrichment/Dockerfile

FROM python:3.11-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY connector.py .
CMD ["python", "connector.py"]

connectors/ai-enrichment/requirements.txt

pycti>=6.2.0
anthropic>=0.40.0

9.4 Deploy the AI Connector

Prerequisites: Set ANTHROPIC_API_KEY in .env first.

cd /home/andrey/openCTI
# Build the image
docker compose -f docker-compose.ai.yml build
# Start it
docker compose -f docker-compose.ai.yml up -d
# Verify it registered with OpenCTI (look for "AI Enrichment" in connector list)
docker logs opencti-connector-ai-enrichment-1 --tail=20

In the OpenCTI UI: Settings → Connectors → Enrichment — the connector should appear with status connected after ~10 seconds.

9.5 Testing the Pipeline

Trigger a manual enrichment by importing a real threat report:

# Import a STIX report via the API to trigger the connector
curl -s -X POST http://localhost:8080/graphql \
  -H "Authorization: Bearer $(grep OPENCTI_ADMIN_TOKEN .env | cut -d= -f2)" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "mutation { reportAdd(input: { name: \"Test: APT29 spearphishing campaign\", description: \"APT29, also known as Cozy Bear, conducted a spearphishing campaign targeting NATO members using a malicious PDF dropper that installed Cobalt Strike beacon via PowerShell (T1059.001). The campaign targeted defense contractors in Poland and Germany. The malware communicated with C2 over HTTPS using domain fronting (T1090.004).\", published: \"2024-01-15T00:00:00Z\", report_types: [\"threat-report\"] }) { id name } }"
  }'

Then check what the AI connector wrote back:

# Watch connector logs for the enrichment
docker logs -f opencti-connector-ai-enrichment-1 2>&1 | grep -E "Enriching|Enriched|Error"
# Expected output:
# Enriching report: Test: APT29 spearphishing campaign
# Enriched: 1 actors, 1 malware, 2 techniques

In the UI, open the report — it should now have a Note with the summary, relationships to APT29 and Cobalt Strike, and links to T1059.001 and T1090.004.

9.6 Cost and Rate Limiting

Estimated Claude API cost per report:

• ~500–2000 tokens input (report text, truncated at 8000 chars)
• ~300 tokens output (JSON response)
• At claude-opus-4-7 pricing: ~$0.01–0.05 per report

Rate limiting: The Anthropic API has per-minute token limits. If AlienVault imports hundreds of reports in a burst, the connector will hit rate limits. Add a simple backoff:

import time
def _call_claude(self, content: str) -> dict | None:
    for attempt in range(3):
        try:
            msg = self.client.messages.create(...)
            return json.loads(msg.content[0].text)
        except anthropic.RateLimitError:
            time.sleep(60 * (attempt + 1))
        except (json.JSONDecodeError, anthropic.APIError) as e:
            self.helper.log_error(f"Claude call failed: {e}")
            return None
    return None

To limit scope (only enrich reports above a confidence threshold, skip low-quality feeds):

def process_message(self, data: dict) -> str:
    report = self.helper.api.report.read(id=entity_id)
    # Skip reports with low confidence (e.g. AlienVault auto-generated)
    if report.get("confidence", 0) < 40:
        return "Skipped: low confidence"
    return self._enrich_report(report)

9.7 Rules Engine (CE Automation)

Note: Playbooks are an Enterprise Edition feature. The Community Edition uses the built-in Rules Engine, which automatically infers and propagates relationships as data arrives.

All 20 rules are enabled. To verify or toggle: Settings → Customization → Rules

To enable all rules via API (already done — included for re-initialization):

RULES="attribution_attribution attribution_targets indicate_sighted attribution_use \
localization_of_targets location_location location_targets participate-to_parts \
observable_related observe_sighting part_part part-of_targets sighting_incident \
sighting_observable sighting_indicator report_ref_identity_part_of \
report_ref_indicator_based_on report_ref_observable_based_on \
report_ref_location_located_at parent_technique_use"
TOKEN=$(grep OPENCTI_ADMIN_TOKEN /home/andrey/openCTI/.env | cut -d= -f2)
for rule in $RULES; do
  curl -s -X POST http://localhost:8080/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"query\":\"mutation { ruleSetActivation(id: \\\"$rule\\\", enable: true) { id activated } }\"}" \
    | python3 -c "import sys,json; d=json.load(sys.stdin); print('$rule:', d['data']['ruleSetActivation']['activated'])"
done

What these rules do automatically once data arrives:

RuleEffectattribution_attributionIf APT-X is attributed to Country-A, and APT-Y is a sub-group of APT-X → APT-Y also attributed to Country-Asighting_incidentIf an indicator is sighted, automatically raise an Incidentindicate_sightedIf indicator is sighted → infer the targeted entity from the indicator's relationshipreport_ref_indicator_based_onIf a Report references Observable X, and X has an Indicator → auto-link the Indicator to the Reportobservable_relatedIf two objects share a common Observable → infer a related-to relationshipparent_technique_useIf a sub-technique (T1059.001) is used → auto-link parent technique (T1059) as used

For custom event-driven automation in CE, use a pycti script or the AI connector (section 9.1). The pycti library supports streaming the live event feed via helper.listen() — the AI connector in 9.1 uses exactly this pattern.

10. Post-Deployment Hardening

10.1 Reverse Proxy with TLS (nginx)

# /etc/nginx/sites-available/opencti
server {
    listen 443 ssl http2;
    server_name opencti.yourdomain.com;
ssl_certificate     /etc/letsencrypt/live/opencti.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/opencti.yourdomain.com/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    location / {
        proxy_pass         http://127.0.0.1:8080;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_read_timeout 300s;
        client_max_body_size 100m;
    }
}
server {
    listen 80;
    server_name opencti.yourdomain.com;
    return 301 https://$host$request_uri;
}

10.2 Backup Strategy

#!/bin/bash
# /home/andrey/openCTI/scripts/backup.sh
set -euo pipefail
BACKUP_DIR="/mnt/backup/opencti/$(date +%Y%m%d_%H%M%S)"
mkdir -p "$BACKUP_DIR"
# Snapshot ElasticSearch
curl -s -u elastic:${ELASTIC_PASSWORD} \
  -X PUT "http://localhost:9200/_snapshot/backup/snapshot_$(date +%Y%m%d)" \
  -H 'Content-Type: application/json' \
  -d '{"indices": "*", "ignore_unavailable": true}'
# Dump MinIO (reports, files)
docker run --rm \
  --network opencti_network \
  -v "$BACKUP_DIR:/backup" \
  minio/mc:latest \
  mirror myminio/opencti /backup/minio/
echo "Backup completed: $BACKUP_DIR"

10.3 Security Checklist

• Change all default passwords in .env
• Generate unique UUID4 tokens for every connector
• Enable TLS via nginx reverse proxy
• Restrict port 8080 to localhost only (127.0.0.1:8080:8080)
• Enable ElasticSearch authentication (already configured above)
• Set up fail2ban on the nginx access log
• Rotate OPENCTI_ADMIN_TOKEN every 90 days
• Review TLP markings — ensure nothing RED leaks via TAXII
• Enable audit logging: APP__APP_LOGS__LOGS_LEVEL: info

11. Operational Runbook

Day 1 — Initial Data Load

# MITRE ATT&CK loads first (foundational framework)
# Wait ~10 minutes for it to complete, then verify:
TOKEN=$(grep OPENCTI_ADMIN_TOKEN /home/andrey/openCTI/.env | cut -d= -f2)

curl -s -X POST http://localhost:8080/graphql \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "{ attackPatterns { edges { node { name } } } }"}' | \
  python3 -c "import sys,json; d=json.load(sys.stdin); print('Techniques loaded:', len(d['data']['attackPatterns']['edges']))"
# Should return 500+ techniques

Common Operations

# Check all connector health
docker compose -f docker-compose.connectors.yml ps
# View connector logs
docker compose -f docker-compose.connectors.yml logs --tail=50 connector-alienvault
# Restart a stuck connector
docker compose -f docker-compose.connectors.yml restart connector-malwarebazaar
# Scale workers for high ingest load
docker compose -f docker-compose.yml up -d --scale worker=5
# Check ElasticSearch cluster health
curl -s -u elastic:${ELASTIC_PASSWORD} http://localhost:9200/_cluster/health?pretty
# Check RabbitMQ queue depth (should stay near 0 at rest)
docker exec $(docker ps -qf name=rabbitmq) rabbitmqctl list_queues name messages

Monitoring Metrics to Watch

Quick Reference

# Start everything
cd /home/andrey/openCTI
docker network create opencti_network 2>/dev/null || true
docker compose -f docker-compose.yml up -d
docker compose -f docker-compose.connectors.yml up -d
docker compose -f docker-compose.ai.yml up -d
# Stop everything
docker compose -f docker-compose.ai.yml down
docker compose -f docker-compose.connectors.yml down
docker compose -f docker-compose.yml down
# Access
# UI:      http://localhost:8080
# API:     http://localhost:8080/graphql
# MinIO:   http://localhost:9001
# RabbitMQ: http://localhost:15672

12. Troubleshooting

Known Issues — OpenCTI 6.2.0 + ElasticSearch 8.13

ILM Race Condition (resource_already_exists_exception)

ES 8.13’s ILM daemon auto-bootstraps rollover indices the moment an index template with lifecycle.rollover_alias is created. OpenCTI's elCreateIndex does a check-then-create which loses the race. This kills initialization and loops with restart: always.

Fix already applied: patches/back.js is mounted over the compiled bundle and makes elCreateIndex idempotent — it catches resource_already_exists_exception and returns null.

Re-initialization procedure (if ES volume is dropped):

# 1. Delete any leftover index templates from a failed run
curl -s -u elastic:${ELASTIC_PASSWORD} -X DELETE \
  "http://localhost:9200/_index_template/opencti*"

# 2. Flush Redis state
docker exec opencti-redis-1 redis-cli -a opencti FLUSHALL

# 3. Start ES first, wait for green/yellow
docker compose up -d elasticsearch
until curl -s -u elastic:${ELASTIC_PASSWORD} \
  http://localhost:9200/_cluster/health | grep -q '"status":"green"\|"status":"yellow"'; do
  sleep 5; done

# 4. Start the rest — OpenCTI will create 13 indices and load base STIX data (~5-10 min)
docker compose up -d

ElasticSearch Disk Watermark (cluster RED, no shard allocation)

ES 8.x refuses all shard allocation when disk exceeds 90% high watermark. cluster.routing.allocation.disk.threshold_enabled=false is set in docker-compose.yml.

To reclaim disk space:

docker system prune -a   # frees ~47 GB of unused images/containers

Connectors Can’t Reach opencti Hostname

Both compose files must share the same Docker network. docker-compose.yml defines:

networks:
  default:
    name: opencti_network
    external: true

If the main stack was started without this, run:

docker network connect --alias opencti opencti_network opencti-opencti-1

Then add the networks: block to docker-compose.yml and run docker compose up -d to make it permanent.

OPENCTI_TOKEN vs CONNECTOR_ID

Connectors authenticate to OpenCTI using OPENCTI_TOKEN: ${OPENCTI_ADMIN_TOKEN}. The per-connector UUID variables (CONNECTOR_MITRE_TOKEN, etc.) are only used as CONNECTOR_ID — they identify the connector instance in the UI, not for authentication.

CVE Connector — Zero Vulnerabilities Imported (NVD API Key Bug)

connector-cve:6.2.0 has a bug: it sends the NVD API key as Bearer: <key> in the HTTP header, but NVD 2.0 API requires apiKey: <key>. The connector silently gets a non-200 response and imports nothing. Additionally, CVE_MAX_DATE_RANGE is required but missing from the image's default config — omitting it causes a TypeError: '>' not supported between instances of 'NoneType' and 'int' crash every 60 seconds.

Fix: Mount a patched api.py that uses the correct header, and add the missing vars:

connector-cve:
  image: opencti/connector-cve:6.2.0
  volumes:
    - ./patches/cve/api.py:/opt/opencti-connector-cve/services/client/api.py:ro
  environment:
    CVE_MAX_DATE_RANGE: 120
    CVE_MAINTAIN_DATA: "true"
    # ... other vars

patches/cve/api.py — change header from "Bearer": api_key to "apiKey": api_key:

headers = {"User-Agent": header}
if api_key:
    headers["apiKey"] = api_key

13. Usage Examples

13.1 Standard OpenCTI Workflows

Example 1 — Investigate an IP address

You received an alert from your SIEM about suspicious outbound traffic to 103.113.70.102.

In OpenCTI UI:

Search → type 103.113.70.102

If AlienVault or URLhaus has seen it, you’ll find:

• Which threat actor uses this IP as C2
• What malware family communicates with it
• When it was first/last observed
• TLP marking and confidence score
• All reports that mention it

Via API:

TOKEN=$(grep OPENCTI_ADMIN_TOKEN /home/andrey/openCTI/.env | cut -d= -f2)
curl -s -X POST http://localhost:8080/graphql \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "{ stixCyberObservables(filters: {mode: and, filters: [{key: \"value\", values: [\"https://103.113.70.102/bin/support.client.exe\"]}], filterGroups: []}) { edges { node { id entity_type ... on Url { value } } } } }"}' | python3 -m json.tool

Example 2 — Build an APT profile

You want to understand everything known about Lazarus Group before a threat briefing.

Threats → Intrusion Sets → search "Lazarus"

The profile shows:

• Attributed to: North Korea
• Motivations: Financial gain, Espionage
• Targets: Finance, Cryptocurrency, Defense
• Malware used: WannaCry, Hermes, BLINDINGCAN (all auto-linked by MITRE connector)
• Techniques: 80+ ATT&CK techniques with usage relationships
• Campaigns: Operation AppleJeus, Dream Job, etc.
• Timeline: chronological view of all activity

Click “ATT&CK Patterns” tab → heatmap showing which techniques Lazarus uses most.

Example 3 — Import a threat report (PDF / blog post)

You found a Mandiant or CrowdStrike blog post about a new campaign.

Data → Import → drag and drop the PDF or paste the URL
Select format: "Auto detect" or "Report"

OpenCTI parses it and creates a Report object. The AI enrichment connector then picks it up automatically and extracts:

• Threat actors mentioned
• Malware families
• ATT&CK technique IDs
• Targeted sectors and countries

All as STIX relationships, visible immediately in the UI.

Example 4 — Track a CVE across your environment

CVE-2024–21762 (Fortinet FortiOS RCE) was just published. Check what you know about it.

Arsenal → Vulnerabilities → search "CVE-2024-21762"

After the CVE connector syncs, you’ll see:

• CVSS score and vector
• Affected software versions
• Which threat actors exploit it (once AlienVault/MITRE data arrives)
• Which campaigns used it
• Related indicators (IPs, domains used in exploitation)

Example 5 — Create an incident from a sighting

Your EDR detected Cobalt Strike beacon on a workstation.

Activities → Incidents → Create
  Name: "CS beacon on WS-042"
  Type: "Intrusion"
  Confidence: 90
  Add object: link to Cobalt Strike (malware)
  Add object: link to T1071.001 (C2 over HTTP)
  Add observable: add the C2 IP

With sighting_incident rule enabled, future detections of the same C2 IP automatically raise new incidents without manual work.

Example 6 — Export IOCs to your firewall / SIEM

You want a live blocklist of all HIGH confidence IPv4 indicators.

Data → Indicators
Filter: Score > 70, Type = IPv4-Addr, Valid until > today
Export → CSV or STIX

Or use the built-in TAXII 2.1 server to push directly to your SIEM:

Settings → Taxii Server → Create collection "High confidence IOCs"
Configure your SIEM to poll: http://localhost:8080/taxii2/

Example 7 — Map your detection coverage against ATT&CK

You want to know which techniques you detect vs which you’re blind to.

Technics → Attack Patterns
Filter by: used by (Lazarus Group)

Cross-reference the list with your SIEM detection rules. Techniques with no detection rule = gap in coverage.

Export the filtered list as CSV and import into ATT&CK Navigator for a visual heatmap of covered vs uncovered techniques.

Example 8 — Pivot from malware to infrastructure

You found a Ryuk ransomware sample (SHA256 hash).

Search → paste the SHA256

From the malware object, pivot to:

• Related indicators → domains and IPs used for C2
• Used by → Wizard Spider (threat actor)
• Campaigns → which ransomware campaigns used this variant
• Techniques → T1486 (Data Encrypted for Impact), T1490 (Inhibit System Recovery)

Each pivot is one click in the graph view.

Example 9 — Share intelligence with a partner org

You want to share a report with a partner but strip out RED-marked internal data.

Open the report → Actions → Share
Select TLP level: TLP:AMBER (only partner can see it)

Or use Workspaces → Sharing groups to create a federated share with another OpenCTI instance. All objects above RED are automatically excluded from the export.

Example 10 — Build a custom dashboard for your sector

Your org is in Finance. You want a live dashboard showing threats to your sector.

Home → Dashboards → Create dashboard "Finance Threat Landscape"
Add widgets:
  - "Threat actors targeting Finance" (bar chart)
  - "Most used techniques against Finance" (ATT&CK heatmap)
  - "New IOCs last 7 days" (timeline)
  - "Active campaigns" (list)
  - "CVEs affecting banking software" (table)

Each widget auto-updates as new data arrives from connectors.

If you like this research, buy me a coffee (PayPal) — Keep the lab running

Follow for practical cybersecurity research

If you’re interested in Offensive security, AI security, real-world attack simulations, CTI, and detection engineering — this is exactly what I focus on.

Stay connected:

→ Subscribe on Medium: medium.com/@1200km
→ Connect on LinkedIn: andrey-pautov
→ GitHub — tools & labs: github.com/anpa1200
→ Contact: 1200km@gmail.com

Andrey Pautov

Follow My Work

I publish practical cybersecurity research, CTI workflows, detection engineering notes, malware analysis projects, OpenCTI work, cloud and Kubernetes security research, AI-assisted security tooling, labs, and technical guides.

Portfolio / Knowledge Base: https://1200km.com/
Medium: https://medium.com/@1200km
GitHub: https://github.com/anpa1200
LinkedIn: https://www.linkedin.com/in/andrey-pautov/

Andrey Pautov

The Intelligent Shield. OpenCTI was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

[DTensor] Support _StridedShard to Shard through all-to-all

Summary

This PR adds support for redistributing tensors from _StridedShard placement to Shard placement using the all-to-all collective operation.

The key challenge is that _StridedShard produces non-contiguous (interleaved) shards, so converting to a regular Shard placement requires:

1. Properly computing padding for both the source strided dimension and target dimension
2. Reordering elements after the all-to-all to restore contiguous layout

Example: Converting _StridedShard(0, split_factor=2) to Shard(1)

Consider the following setup:

• Mesh shape: (4,) — 4 ranks on a single mesh dimension
• Original tensor shape: (9, 4)
• Source placement: (_StridedShard(0, split_factor=2),)
• Target placement: (Shard(1),)

Step 1: Understand the _StridedShard distribution

With _StridedShard(0, split_factor=2), the tensor is conceptually split in two levels on dimension 0:

1. First level: Split into split_factor=2 pieces → chunks of size ⌈9/2⌉ = 5, giving pieces [0:5] and [5:9]
2. Second level: Each piece is split into num_chunks=4 pieces (mesh size)

The shards are then interleaved so each rank gets one slice from each first-level piece:

Original tensor (9x4):            Strided sharding on dim 0:
┌─────────────────────┐
│ row 0               │  ─┐
│ row 1               │   ├─ First piece [0:5], split into 4 chunks
│ row 2               │   │  → chunks: [0:2], [2:4], [4:5], []
│ row 3               │   │
│ row 4               │  ─┘
│ row 5               │  ─┐
│ row 6               │   ├─ Second piece [5:9], split into 4 chunks
│ row 7               │   │  → chunks: [5:6], [6:7], [7:8], [8:9]
│ row 8               │  ─┘
└─────────────────────┘

Interleaved distribution to ranks:
  Rank 0: rows [0,1] + [5]     = rows [0,1,5]     (3 rows)
  Rank 1: rows [2,3] + [6]     = rows [2,3,6]     (3 rows)
  Rank 2: rows [4]   + [7]     = rows [4,7]       (2 rows)
  Rank 3: []         + [8]     = rows [8]         (1 row)

Step 2: Pad for uniform all-to-all

Before all-to-all, we pad so all ranks have uniform chunk sizes:

• Old dimension (dim 0): max_chunk_size = 3, pad ranks 2 and 3
• New dimension (dim 1): size 4 with 4 chunks → already uniform (chunk size 1 each)

After padding dim 0:
  Rank 0: [0,1,5] (no padding)    → shape (3, 4)
  Rank 1: [2,3,6] (no padding)    → shape (3, 4)
  Rank 2: [4,7,P] (+1 padding)    → shape (3, 4)
  Rank 3: [8,P,P] (+2 padding)    → shape (3, 4)

Step 3: All-to-all on dim 0 → dim 1

The all-to-all exchanges slices: each rank sends dim-1 slices to other ranks and receives dim-0 slices:

Before A2A (each rank has 3x4):     After A2A (each rank has 12x1):
  Rank 0: rows [0,1,5] cols [0,1,2,3]  →  col 0 from all ranks
  Rank 1: rows [2,3,6] cols [0,1,2,3]  →  col 1 from all ranks
  Rank 2: rows [4,7,P] cols [0,1,2,3]  →  col 2 from all ranks
  Rank 3: rows [8,P,P] cols [0,1,2,3]  →  col 3 from all ranks

Step 4: Unpad and reorder

After all-to-all, each rank has interleaved rows from the strided pattern with padding. We use index_select to:

1. Extract only the valid (non-padded) elements
2. Reorder from strided order [0,1,5,2,3,6,4,7,8] back to natural order [0,1,2,3,4,5,6,7,8]

Final result - Shard(1) distribution:
  Rank 0: all 9 rows, col 0  → shape (9, 1)
  Rank 1: all 9 rows, col 1  → shape (9, 1)
  Rank 2: all 9 rows, col 2  → shape (9, 1)
  Rank 3: all 9 rows, col 3  → shape (9, 1)

Pull Request resolved: #170915
Approved by: https://github.com/weifengpy

Read more of this story at Slashdot.

These “short-sleeve” keys, named for how the 0 bits don’t fully cover the limbs of the big integers, largely fell into two patterns. Pattern 1 remains unexplained, but we traced pattern 2 to a type mismatch in big-integer code from old versions of the CompleteFTP file transfer software. The CompleteFTP bug also generated vulnerable short-sleeve DSA keys, and we recovered 603 unique RSA private keys and 74 DSA keys from internet scans. If you used CompleteFTP to generate host keys between December 2016 and December 2023, CompleteFTP has released a tool to check whether your keys need to be regenerated.

How we found the weak keys

The badkeys project is an open-source service that checks public keys for known vulnerabilities. While developing this tool, Hanno collected a massive number of real-world keys from public sources, including Certificate Transparency logs, internet-wide TLS and SSH scans, PGP keys, and many others. By searching this dataset for unexpectedly sparse RSA moduli, we uncovered a large number of keys in the wild with the patterns in Figure 1.

Both patterns include several regularly spaced blocks of all zeros interleaved with seemingly random data. Pattern 1 appears in CT logs for certificates issued to several large organizations, including Yahoo and Verizon, and on some devices running NetApp software. Fortunately, these certificates have already expired, but we still shared our findings with these companies. We wanted to learn more about which product could be responsible for generating these keys, but we did not hear back. Pattern 2 appears on SSH hosts running the CompleteFTP software from EnterpriseDT. The underlying vulnerability affects RSA keys generated using versions 10.0.0–12.0.0 (Dec 2016–Mar 2019) and DSA keys generated with v10.0.0–23.0.4 (Dec 2016–Dec 2023).

These vulnerabilities affect a small minority of hosts on the internet, but the more interesting takeaway is that independent cryptographic implementations failed in similar ways. More implementations may include the same bugs, and so it’s worth tailoring cryptanalytic algorithms for this particular type of failure.

Factoring with polynomials

Cryptographic algorithms often need integers hundreds or thousands of bits long, and they represent these “big integers” using an array of smaller machine-sized values, called limbs. If we interpret pattern 1 as a sequence of 128-bit limbs, or 32-bit limbs in pattern 2, the repeated blocks of zeros correspond to a single block of zeros in each limb. Only a small contiguous subset of the limb is filled with random bits, and the rest of the limb is uncovered, hence the nickname “short-sleeve keys.”

By exploiting this mathematical structure in the limbs of these moduli, we replace the hard problem of factoring integers with the easy problem of factoring polynomials. That is, we take the modulus $n$ with unknown factors $p$ and $q$, express it as a polynomial $f_n(x)$ with small coefficients, factor $f_n(x)$ into $f_p(x)$ and $f_q(x)$, and convert these factors into $p$ and $q$. The technique of converting between integers and polynomials is common, including doing fast polynomial multiplication, but sadly, few resources describe how to use it for fast integer factorization.

In particular, we use the digits in the base-$B$ representation of the integer to set the coefficients of the polynomial. In the normal base-10 representation, this involves replacing powers of 10 with powers of $x$, and then converting a polynomial back to an integer involves replacing powers of $x$ with powers of 10. Mathematically, the base-$B$ representation of an integer $a = \sum_i a_i B^i$ corresponds to the polynomial $f_a(x) = \sum_i a_i x^i$, and the polynomial evaluation $a = f_a(B)$ converts back to an integer. For short-sleeve keys, the base corresponds to the limb size, and the extra zero bits in each limb will lead to polynomials with exceptionally small coefficients.

This method of representing integers with polynomials is useful because the product of evaluations $f_a(B) * f_c(B)$ equals the evaluation of the product $(f_a*f_c)(B)$. All evaluation does is replace $x$ with $B$, so it doesn’t matter if this happens before or after multiplication. The same is true of addition.¹

For a short-sleeve RSA modulus $n$ with $w$-bit limbs, we can use the base-$2^w$ representation to find a polynomial $f_n(x)$ with exceptionally small coefficients. If $f_p(x)$ and $f_q(x)$ also have exceptionally small coefficients, then $f_n(x) = f_p(x) * f_q(x)$. Note that for correctly generated prime factors, $f_p(x)$ and $f_q(x)$ will typically have $w$-bit coefficients; that’s why this attack doesn’t work in general.

Factoring polynomials is easy, so we can factor $f_n(x)$ to get $f_p(x)$ and $f_q(x)$, then evaluate these factors at $2^w$ to get $p$ and $q$. This is the basic version of the attack, but I’m intentionally omitting a key insight needed to factor these real-world moduli. A full explanation is at the end of this blog.

The correspondence between integers and polynomials makes it easy to factor these special form moduli, but interestingly, it helps factor general RSA moduli as well. The General Number Field Sieve (GNFS) algorithm has the best known asymptotic performance, and the first step is defining a number field by selecting a polynomial $f_n(x)$ and evaluation point $m$ such that $f_n(m) = n$.²

Reverse engineering the CompleteFTP vulnerability

After applying this technique to the keys that Hanno found, we found that the private factors are indeed short-sleeved: the prime factors have large, regularly spaced blocks of unset bits. The SSH banners for the hosts with the second pattern indicate they use the CompleteFTP software, so we reverse-engineered a trial version to determine what caused the vulnerable keys.

Dynamically generated RSA keys did not have the short-sleeve pattern³, so we used the ILSpy tool to decompile the .NET code in the demo binary. After some reverse engineering, we found the bug that generated the short-sleeve keys. The following function fills the big integer represented by bignumLimbs with a randomly generated value of the desired bit length. See if you can spot the problem.

public void genRandomBits(int bits) {
 	// Calculate the number of limbs
 	int numLimbs = bits / 32;
 	// Allocate space for the RNG output
 	byte[] array = new byte[numLimbs];
 	// Call the system RNG
 	rngProvider.GetNonZeroBytes(array);
 	// Copy to the limbs of the big number
 	Array.Copy(array, 0, bignumLimbs, 0, numLimbs);
 	// Set the top bit to ensure proper bit length
 	bignumLimbs[numLimbs - 1] |= 0x80000000;
 	// Store the length
 	dataLength = numLimbs;
}

There’s a mismatch between the size of the limbs and the size of the RNG output! Each limb requires 32 bits of random material, but Array.Copy implicitly casts each 8-bit element of the RNG output to its own element of the big-integer limbs. The repeating structure in the short-sleeve keys is because the issue affects each limb, and the 0 bits are because too small of a value is copied to each limb. This exactly matches the pattern of the cryptanalyzed keys.

We also figured out why our dynamic testing did not generate broken keys: the genRandomBits function was compiled in but unreachable in the latest version. Older versions used custom-written key-generation code that called this vulnerable function, which was later refactored to use standard .NET crypto APIs.

We reverse-engineered an older version of the CompleteFTP software to look for other calls to genRandomBits and found that DSA key generation was also affected. The 160-bit DSA private key $x$ was previously generated by this function, and the public key and parameters include a generator $g$ and target $y = g^x$. The private key is easily recoverable, and once we knew what to look for, we found vulnerable DSA keys in the wild as well.⁴

Since v12.1.0, CompleteFTP generates RSA keys using .NET’s RSACryptoServiceProvider, and since v23.1.0, it generates DSA keys using the DSA.Create API.

How the vulnerability spread, and how it was contained

The decision to refactor key-generation code to use standard libraries significantly mitigated the scope of the impact. This is actually reflected in the data. Prof. Nadia Heninger has a large collection of historical and contemporary SSH scans that we used to find broken SSH RSA signatures, so I checked to see whether it included CompleteFTP hosts. There were typically hundreds of CompleteFTP hosts in each IPv4-wide scan, and after aligning the historical scans to the release history, the trend is clear.

Starting with the introduction of the RSA vulnerability in December 2016, there was a consistent increase in the number of hosts with vulnerable keys, and once the rewritten RSA code was released in March 2019, this trend immediately stopped. However, even though the number of hosts running an affected version has steadily decreased since then, the proportion of affected keys has plateaued, consistent with customers who regularly update their software but generate their keys only once.

The EnterpriseDT team was very responsive throughout disclosure. To help these users, EnterpriseDT released v26.1.0 of CompleteFTP on May 8, 2026; this update automatically checks if the system is using a vulnerable RSA or DSA key and alerts the user if the key needs to be regenerated. They also released a standalone tool that does the same. In addition, the badkeys website and standalone tool now support the detection of vulnerable short-sleeve RSA keys.

In total, we recovered private keys for 603 unique RSA public keys and 74 DSA keys generated by vulnerable versions of CompleteFTP, and 26 RSA keys with the unidentified short-sleeve pattern. Our data sources are heavily biased toward RSA SSH keys, so these numbers do not reflect the actual prevalence.

The search for more short-sleeve keys

Unfortunately, we do not have more information about short-sleeve pattern 1, nor do we know whether that vulnerability extends to other key types. It’s common for cryptanalytic algorithms to exploit knowledge of irregularly spaced blocks of known bits (including ECDSA⁵ and RSA⁶), but the regular spacing of short-sleeve leakage adds new structure, and there may be powerful variants of these algorithms that can exploit this property. If this type of leakage appears in two independent implementations of RSA, there are likely to be even more examples of short-sleeve keys out there.

In this instance, the impact of the vulnerabilities is fortunately limited, but it illustrates the power of practical research. The process of using known vulnerabilities to inspire more capable algorithms and using these algorithms to uncover new vulnerabilities generates a powerful feedback loop in cryptanalysis. It helps us understand how real cryptographic systems fail in practice, and it is only by observing how systems break that we learn how to make them more secure.

Acknowledgments

Thank you to Nadia Heninger for introducing me to Hanno and for letting me use the SSH scans for this project. Those scans consist of historical data from Censys and the University of Michigan provided by Zakir Durumeric and contemporary data and analysis scripts from Kevin He and George Sullivan.

Appendix

This final section is intended for those who want to implement the attack or write a proof that the attack works. I left out key details from the main post, but the following guided questions will help you close that gap. First, here are the full moduli for you to factorize. They are synthetically generated, but follow the same pattern as keys in the wild. The factors of $n_2$ were generated by calling genRandomBits(1024) in a loop until the result was prime.

n_1=0xc889f7ef523b08e400000000000000014d2ee8284c7a03c000000000000000012c16eeaeab96ddc8000000000000000201036d671407a06600000000000000022f743377005a840d0000000000000001e8e3c0efdd8054ba000000000000000306ee98c677dfdf190000000000000002de525d2b1011ceae0000000000000424455c59eec3a0654500000000000003f8d762d68bcbe8cc3a00000000000000d31291f9aaa7e9a7d60000000000000337a82a59342aadff570000000000000295c495b3690a69b66c00000000000000d9c5e55654e9b14cba000000000000040f0f0f7d3bfdce03d6000000000000026b89ac77db000000000000000000036a77
n_2=0x40000049000014ac8000900e00010ec58000b17b8001e0720001be890002169f80029cd5000349190003cd4480037c8c000397660003b28300041021000418cb00058a210004c2708004924980053b8780051cbd8005ebe80006bb27800765e6800651478007f62300073949800860950008614d800863988008d103800884c100099a260009a6d90009578f0007e84300080db800072e59000724f10007c0ec0006ec6600062231000605930005ca4c000566cc0005da92000574dd00040bf1000457dc0004cfbe0004c5640003fe6d0003ada60002de110002cbb30002d5a6000243840001cdf40001a8a9000151be000113f4000101070000acdf000029e5

1. If you compute $f_{n_2}(x)$ using $B=2^{32}$, some of the coefficients are large. Why is that? Is it true that all of the coefficients of $f_p(x)$ and $f_q(x)$ are small?
2. Is there a bit shift $p \ll i$ such that $f_{2^i p}(x)$ has small coefficients? This is the key trick needed to turn arbitrary short-sleeve values into polynomials with small coefficients.
3. If $f_{2^i p}(x)$ and $f_{2^j q}(x)$ have small coefficients, can you still compute $f_{2^i p}(x)*f_{2^j q}(x)$ from public information? Can you still recover $p$ and $q$?
4. If this polynomial factorization technique worked for every $p$ and $q$, then RSA would be broken. Why is the short-sleeve property important, and why doesn’t this factorization method work in general? What are the limits?
5. The short-sleeve property allows us to construct the product $f_{2^i p}(x)*f_{2^j q}(x)$, but unless $f_{2^i p}(x)$ and $f_{2^j q}(x)$ are irreducible, factorization may split this into more than two terms. Prove that there is always an efficient way to recover $p$ and $q$ from the polynomial factorization.

Executive Summary

Cyble Research & Intelligence Labs (CRIL) has identified an active SEO poisoning campaign exploiting abandoned cloud DNS zone delegations to serve Thai-language gambling content under the domain authority of reputed enterprise organizations. The campaign has compromised 163 organizations across 30+ countries, spanning federal government agencies, national healthcare systems, financial institutions, critical infrastructure operators, and major universities.

The primary mechanism is the Azure DNS zone takeover. When enterprises decommission cloud infrastructure, NS delegations to Azure DNS zones are routinely left in place. The actor systematically identifies these abandoned delegations, claims the orphaned zones under a fresh Azure subscription, and deploys a Next.js gambling kit behind a valid Let's Encrypt wildcard TLS certificate, all resolving cleanly under the victim's own domain. A browser, a search engine, and a Thai user following a search result all see a page identical to a legitimate enterprise property.

This report documents the full campaign architecture: the pivot chain from initial discovery through infrastructure attribution, the DNS compromise mechanisms observed, the structured affiliate monetization layer with server-side geographic filtering and dual-tier commission tracking, and a dedicated 103-node application backend in Hong Kong tied to a single Chinese operator by twelve independent technical evidence points. At the time of publication, 161 organizations remain actively compromised.

Initial Discovery

During an ongoing vulnerability assessment, CRIL identified an anomalous DNS resolution on the cardsforheroes.verizon.com subdomain environment. What initially appeared to be a single misconfigured endpoint turned out to be 1000+ individually named subdomains, each serving Thai-language online gambling content under Verizon's trusted domain authority.

Every subdomain followed a gambling brand keyword pattern with URL-encoded Thai characters confirming the intended audience. All endpoints resolved to a single IP at OVH SAS (AS16276). Loading a representative endpoint revealed a fully rendered Next.js gambling application with outbound affiliate redirect links.

It matched the structural similarity of 97 other enterprise subdomains across completely unrelated organizations. The affiliate referral parameter on every redirect established the monetization intent immediately: this was not defacement or malware delivery, but a structured operation funneling Thai search traffic to gambling registrations for commission.

The Verizon endpoint was not the campaign's origin. Following it, 162 other compromised organizations were exposed.

Background: The Vulnerability Class

Cloud infrastructure provisioning introduces a category of DNS misconfiguration that is structurally different from the record-level errors security teams routinely audit. When an enterprise provisions Azure resources for a project environment, a standard step is to delegate a subdomain to an Azure DNS zone by adding NS records in the parent DNS zone that point to Microsoft's nameservers for that environment. The zone lives inside the Azure subscription, the team manages its records there, and the project operates normally.

"What consistently fails is the decommissioning step. When the project ends, and the Azure resources are deleted, the NS delegation in the parent DNS zone is not usually removed. It persists silently, pointing any DNS query for that subdomain to Azure nameservers that no longer serve authoritative records for it.

In several cases identified during this investigation, these delegations had been left in place for over six years.

The exploitability of this configuration depends on another condition: whether the Azure DNS zone for that subdomain is claimable by a new subscriber. Microsoft's zone-creation model has historically allowed any subscriber to register a zone by name under their own subscription. A zone abandoned with a canceled subscription can be recreated by a third party, who then inherits the delegated DNS authority that the enterprise's parent zone never revoked.

Our analysis of this campaign demonstrates that awareness has not translated into hygiene at an enterprise scale.

DNS Compromise Mechanisms

Four distinct mechanisms account for the 163 confirmed victims. Each exploits the same underlying failure: a DNS delegation that outlived the infrastructure it was created to serve.

Mechanism 1 — Azure DNS Zone Takeover (150+ Organizations)

The actor identifies subdomains whose NS records still point to Azure DNS nameservers, even though the underlying subscription has been canceled or abandoned. A new Azure subscription is created, the orphaned zone is claimed by name, a wildcard A record is added that points all subdomains to a delivery IP, and ACME HTTP-01 validation is performed through the now-controlled DNS to obtain a Let's Encrypt wildcard certificate. One DNS record exposes every possible subdomain of the environment.

Direct authoritative DNS evidence confirms the mechanism. Querying Microsoft's own nameserver infrastructure returns the actor's wildcard A record. Zone SOA serials of 1 on confirmed victims establish that the zones were created from scratch by the actor, not modified from an existing state. Certificate Transparency logs confirm the dormancy periods:

• A major pharmaceutical company's pilot subdomain: last legitimate certificate October 2019, actor certificate April 11, 2026 — a 6.5-year gap
• A global electronics company's IoT platform: last legitimate certificate February 2023, actor certificate April 10, 2026

The bulk of actor-obtained certificates cluster in April 2026, indicating a concentrated automated exploitation window applied across targets abandoned over multiple years.

Mechanism 2 — DigitalOcean DNS Zone Takeover (2 Organizations)

Two organizations, a US luxury furniture retailer and an Indian university, have their compromised subdomains delegated to DigitalOcean nameservers rather than Azure. Both carry wildcard records resolving to 38.127.8.49.

DigitalOcean's zone-claiming model carries the same structural vulnerability: abandoned DNS zones in canceled accounts become available for re-registration. The actor's tooling targets multiple cloud DNS providers.

Mechanism 3 — Direct Wildcard Misconfiguration (2 Organizations)

A US energy company's development subdomain and a mobile payments platform's development subdomain both resolve via wildcard to 139.99.82.106, even though there is no cloud DNS zone delegation. Both use their own organizational nameservers, making cloud zone takeover mechanically impossible.

The wildcard records resolve from within the parent zone, indicating either an orphaned wildcard A record left in the organization's own DNS console when a project was decommissioned, or a direct DNS management access path the actor exploited. "A wildcard A record in the DNS console of a payments platform is a more direct access path than a cloud zone takeover.

Mechanism 3 — Direct Wildcard Misconfiguration (2 Organizations)

A US energy company's development subdomain and a mobile payments platform's development subdomain both resolve via wildcard to 139.99.82.106, even though there is no cloud DNS zone delegation. Both use their own organizational nameservers, making cloud zone takeover mechanically impossible.

The wildcard records resolve from within the parent zone, indicating either an orphaned wildcard A record left in the organization's own DNS console when a project was decommissioned, or a direct DNS management access path the actor exploited. "A wildcard A record in the DNS console of a payments platform is a more direct access path than a cloud zone takeover.

Mechanism 4 — Per-Subdomain A Records (1 Organization)

The Verizon environment represents a distinct approach: 1000+ individually named A records rather than a single wildcard. Each gambling-keyword subdomain is a separately created DNS entry pointing to 51.79.199.51. This implies either an automated DNS API script with zone-write access or a compromised DNS management credential that enabled bulk record creation.

Technical Analysis

Pivoting: From One Endpoint to 163 Organizations

Pivot 1: 51.79.199.51 — Primary Delivery Node and First Scope Expansion

The first pivot came from the primary delivery IP itself. Cross-referencing 51.79.199.51 against passive DNS resolution data and page fingerprint matching returned over 90 enterprise subdomains serving identical content, confirmed by:

• Identical Next.js build ID: QQOrXCFjoI6C9oF-4YVhl
• Identical favicon path: /img/ib99-hq.ico
• Outbound affiliate redirects to the same three destination domains across every result

Every result was a subdomain of a legitimately owned enterprise domain with a clean reputation. Standard threat intelligence feeds returned no signal on any of them. The shared page fingerprint expanded the confirmed victim set from 1 organization to over 90 in a single query.

Pivot 2: 139.99.82.106 and 38.127.8.49 — Secondary and Tertiary Delivery Nodes

Passive DNS resolution data against AS16276 (OVH) surfaced two additional delivery IPs operating in parallel. Both served the identical gambling kit with the same build fingerprint across a partially overlapping but distinct victim set. Government agencies, healthcare organizations, and several non-Azure takeover victims routed through these two nodes rather than the primary. Together, the three OVH nodes account for the full 163-organization victim estate. All three presented clean IP reputations, no prior association with threat actors, and standard deployment signatures at the surface level.

Pivot 3: 38.173.56.218 — The JARM Anomaly That Exposed the Backend

JARM TLS fingerprinting against the primary delivery node returned thousands of global matches, nearly all of them generic shared hosting providers. One result stood apart by every observable metric: 38.173.56.218 in Hong Kong, AS398478 (PEG TECH INC), presenting:

• A ThinkPHP application framework error on port 443
• A Chinese server management panel certificate identity on port 21
• MySQL 5.7.44-log on port 3306

Where every other JARM match represented commodity hosting, this node showed a purpose-built application stack managed from mainland China. This was the single point of entry from the OVH delivery layer into the backend infrastructure. Figures 2 and 3 showcase these using findings from ODIN by Cyble.

Affiliate Architecture: How the Campaign Monetizes

Every destination redirect carries a ?rc= affiliate code — ibiza99vip1, bigwinv1, link99, or seven77vip1 — that attributes completed registrations to the actor and triggers a commission payout from the destination platform. This is standard affiliate marketing infrastructure; legal and illegal gambling operations use it. A server-side layer beneath the visible code separates this campaign from simple redirect farms. A POST request intercepted at a live endpoint returned this before any redirect was issued:

• "status": "ok",
•  "msg": "TH - Referrer verified",
•  "data": { "referrer": "link99" },
•  "x-token": ""

The backend validates geographic origin server-side. Requests from outside Thailand are not redirected, keeping traffic focused and limiting scanner exposure. The link99 identifier is a sub-affiliate publisher ID that sits above the ?rc= codes in the platform's tracking hierarchy.

The actor earns at both tiers: publisher-level credit under link99 for delivering Thai traffic, and a per-registration payout under the ?rc= code for each conversion. The two layers are independent — campaign codes can rotate while link99 persists as the actor's permanent platform identity.

Pivoting on the Let's Encrypt certificate presented by this node, issued to broker-xm.com, returned 103 IPs across seven contiguous /24 subnets in 38.173.0.0/16, all within AS398478. A single certificate deployed across 103 servers in a wholesale-allocated IP block produced the complete backend fleet inventory from one certificate query.

Affiliate Architecture: How the Campaign Monetizes

Every destination redirect carries a ?rc= affiliate code — ibiza99vip1, bigwinv1, link99, or seven77vip1 — that attributes completed registrations to the actor and triggers a commission payout from the destination platform. This is standard affiliate marketing infrastructure; legal and illegal gambling operations use it. A server-side layer beneath the visible code separates this campaign from simple redirect farms. A POST request intercepted at a live endpoint returned this before any redirect was issued:

• "status": "ok",
•  "msg": "TH - Referrer verified",
•  "data": { "referrer": "link99" },
•  "x-token": ""

The backend validates geographic origin server-side. Requests from outside Thailand are not redirected, keeping traffic focused and limiting scanner exposure. The link99 identifier is a sub-affiliate publisher ID that sits above the ?rc= codes in the platform's tracking hierarchy.

The actor earns at both tiers: publisher-level credit under link99 for delivering Thai traffic, and a per-registration payout under the ?rc= code for each conversion. The two layers are independent — campaign codes can rotate while link99 persists as the actor's permanent platform identity.

Four destination platforms have been confirmed — ibiza99.autos, big888.store, seven77.click, and stillsunday.pl. These domains are white-label deployments on a shared codebase, as confirmed by identical CSS hashes and JavaScript resilience logic across all three, except big888.store, which carries active Google Search Console verification, indicating the platform operator runs its own independent SEO operation beyond this campaign. Each platform maintains its own appbox.* CDN subdomains, a fourth infrastructure layer entirely separate from the delivery nodes, backend fleet, and victim domains.

The Gambling Kit: What the Endpoint Delivers

An HTTP request to any compromised enterprise subdomain with Thai locale headers returns a fully rendered Next.js page that returns a legitimate enterprise web property. The page presents

• lang="th" with Thai-language gambling platform branding
• A valid Let's Encrypt wildcard TLS certificate matching the victim subdomain, clean browser padlock, no warnings
• Schema.org FAQ structured data with Thai-language answers about minimum deposits, withdrawal timelines, and mobile compatibility, directly targeting the queries Thai users make when researching gambling platforms
• AMP alternate links for Google mobile indexing coverage
• Static assets served from paths under the compromised domain itself, using the victim's domain authority as a CDN

The minimum deposit advertised across all kit variants is 1 Thai Baht, approximately $0.03 USD. The 1-baht minimum ($0.03 USD) removes the deposit threshold that causes most users to abandon the registration flow before converting. The kit fingerprint is consistent across the entire victim estate, regardless of which victim domain or OVH node serves the content, confirming centralized build and deployment by a single operator.

Backend Infrastructure: The Hong Kong Fleet

The three OVH delivery nodes handle content distribution, but the application layer sits entirely within a separate dedicated infrastructure in Hong Kong. The 103-node backend fleet is distributed across seven /24 subnets within 38.173.0.0/16, all under AS398478 (PEG TECH INC). Seven independent evidence points converge on single-operator control; the MD5 match across all 103 nodes on port 80 alone eliminates coincidence.

Detection and Hunting

The campaign produces no signal in standard security controls. Valid TLS certificates, clean IP reputation, trusted domain names, and no exploit delivery mean conventional tooling produces no signal. Detection requires operating at the DNS layer.

Certificate Transparency monitoring is the most reliable early indicator. An unexpected Let's Encrypt wildcard certificate on a corporate-owned subdomain, particularly following a period of no issuance, is an anomaly no legitimate provisioning scenario produces. Monitoring CT logs for wildcard certificates whose expected issuer is a corporate or premium CA would have detected every Azure takeover victim at the time of certificate issuance.

Azure DNS zone delegation auditing is a structural prevention control. Organizations should enumerate all NS delegation records in their parent DNS zones and verify that corresponding Azure DNS zones exist in subscriptions they own and actively manage. 163 organizations across 30 countries had gambling content served under their domain authority without any alert firing. One class of DNS misconfiguration enabled it.

Wildcard DNS testing confirms active exploitation. A randomized nonsense hostname query against any Azure-delegated subdomain that returns a resolution should be treated as a compromised zone until proven otherwise.

Network and endpoint detection rules:

• DNS answers resolving to 51.79.199.51, 139.99.82.106, or 38.127.8.49
• URL query parameters containing rc=ibiza99vip1, rc=bigwinv1, or rc=seven77vip1 or rc=link99
• HTTP requests to /img/ib99-hq.ico
• Outbound connections to 38.173.30.0/24, 38.173.37.0/24, 38.173.56.0/24, 38.173.57.0/24, 38.173.235.0/24, 38.173.236.0/24, or 38.173.239.0/24

Internet scanning queries:

• HTTP body MD5: 7df3d7cf3358af3f470ac7229387ef94
• TLS certificate CN: broker-xm.com
• ASN sweep: AS398478

Remediation

For Azure DNS zone takeover victims:

1. Remove the NS delegation from your parent DNS zone immediately. This severs the attack chain regardless of what the actor maintains inside the Azure zone, which is under their control and cannot be directly modified by the victim organization.
2. Report the abandoned zone to Microsoft MSRC at msrc@microsoft.com with the zone name and evidence. Microsoft can force-remove zones from subscriptions holding abandoned delegations.
3. Request revocation of any Let's Encrypt certificates issued against the compromised subdomain using the certificate serial numbers from crt.sh.
4. Audit all remaining subdomains for additional environment-style entries (dev, uat, staging, preprod, pilot, lab, test, sandbox) carrying NS delegations to cloud providers, and verify each delegation is intentional, current, and managed.

For DigitalOcean zone takeover victims: Remove the NS delegation from the parent zone and verify whether the DigitalOcean zone exists in an account you own.

For direct wildcard misconfiguration victims: Remove the wildcard A record from your DNS management console. If the origin of the record cannot be identified, treat the DNS management credential as compromised and rotate it immediately.

Conclusion

This campaign demonstrates that enterprise reputational trust can be systematically harvested through a single class of DNS misconfiguration that most organizations have no visibility into. The actor did not breach any perimeter or exploit any application vulnerability. They claimed what had been left unclaimed and built a commercial affiliate operation on top of it.

The scale, 163 organizations across 30+ countries, is not the result of 163 separate attacks. It is an automated scanning process applied to a single vulnerability class. A single wildcard record beneath an abandoned Azure delegation exposes an unlimited subdomain namespace, each entry inheriting the full TLS-verified authority of the victim's brand. The campaign lives entirely within legitimate infrastructure, OVH delivery nodes, Let's Encrypt certificates, victim-owned domains, and organic search rankings, which is precisely why conventional controls produce no signal.

Audit your DNS estate. Every abandoned NS delegation pointing to a cloud provider is a candidate for the next version of this list. Every abandoned NS delegation pointing to a cloud provider is a potential entry in the next version of this list. The remediation is simple. The detection methodology is documented here. The gap between a decommissioned project and an actively exploited subdomain closed silently on 163 organizations. In several cases, it stayed closed for over six years.

MITRE ATT&CK® Techniques

Indicators of Compromise (IOCs)

The post Borrowed Trust – Systematic Exploitation of Abandoned Cloud DNS Delegations to serve Thai Gambling SEO Content appeared first on Cyble.

The post Turn specs into evals for any agent with ASSERT appeared first on Microsoft Security Blog.

Read more →

The post Turn specs into evals for any agent with ASSERT appeared first on IT Security News.

The post Smart TV Apps Found Converting Samsung and LG Devices Into AI Proxy Nodes appeared first on Cyber Security News.

Executive Summary

This is an analyst guide, not a formal CTI report. It does not answer a single priority intelligence requirement, assess one actor or campaign end to end, provide an IOC package, or produce a defensive detection plan. Its purpose is narrower: show how cyber threat intelligence analysts can apply Sherman Kent-style analytic discipline to public evidence without overstating what the evidence proves.

Sherman Kent was one of the central figures in professionalizing U.S. intelligence analysis. His writing emphasized clear estimative language, policy relevance, analytic independence, evidence discipline, explicit uncertainty, and the separation of fact from judgment (CIA, Words of Estimative Probability; CIA, The Intelligence Process: A Digest from Strategic Intelligence; CIA, Sherman Kent and the Profession of Intelligence Analysis).

This article uses “Kent-style analytic discipline” as shorthand for that professional tradition. It is not claiming that there is one official, codified “Sherman Kent doctrine” that directly governs modern CTI. The safer claim is that Kent’s principles are consistent with later Intelligence Community analytic standards and structured analytic technique guidance, including ICD 203 and the CIA tradecraft primer (ODNI, ICD 203; CIA, A Tradecraft Primer).

For CTI, this matters because analysts often work from incomplete telemetry, vendor reporting, malware analysis, infrastructure links, victimology, and government attribution statements. Those evidence types do not all prove the same thing. A file hash can support a malware-family claim. A command-and-control pattern can support a campaign link. Victimology can support a targeting assessment. None of those, by itself, proves adversary intent or state tasking.

This guide therefore focuses on one standard: make the reader see where evidence ends and assessment begins.

Table of Contents

Evidence and Confidence Model Used Here

Estimative Probability Reference

What Is Sherman Kent-Style Analytic Discipline?

What Maps From Traditional Intelligence to CTI — And What Does Not

• 1. Policy Relevance Without Policy Capture
• 2. Facts, Assumptions, and Judgments
• 3. Estimative Probability Language
• 4. Confidence Is Not Probability
• 5. Alternative Hypotheses
• 6. Warning, Indicators, and Collection Gaps
• 7. Analytic Integrity in CTI

Cognitive Biases CTI Analysts Should Name

Where ATT&CK and the Pyramid of Pain Fit

Kent-Style Checklist

Practical Analyst Template

Conclusion

References

Evidence and Confidence Model Used Here

This article uses these evidence labels:

• Author-observed: directly inspected by the author. This article rarely uses this label because it is based on public reporting, not original telemetry or reverse engineering.
• Source-observed: the cited source claims direct access to evidence, such as imagery, telemetry, malware samples, incident response data, or official records.
• Reported: stated by a cited source, but not independently verified here.
• Assessed: analytic judgment made by a cited source.
• Inferred: reasonable interpretation made in this article from public evidence, but not directly observed.

Qualifiers are tracked separately from evidence labels:

• Qualifier / limitation: ambiguity, scope limit, alternate explanation, source-access constraint, or reason the evidence should not be overinterpreted.

Confidence attaches to a specific assessment, not to an example as a whole:

• High confidence: strong source access, strong credibility, meaningful corroboration, and a short inference chain.
• Moderate confidence: credible reporting, but incomplete visibility, limited corroboration, contested interpretation, or a longer inference chain.
• Low confidence: plausible inference from thin, indirect, or weakly corroborated evidence.

Every example uses the same four-field confidence basis:

• Source access: direct telemetry, reverse engineering, official record, government statement, vendor incident response, or secondary reporting.
• Source reliability: established, unknown, contested, or mixed.
• Information credibility: corroborated, single-source, inferred, or disputed.
• Author verification: verified, partially verified, or not independently verified here.

This is still not a formal source-grading model. Operational CTI should use a more rigorous source reliability and information credibility system, especially when reporting will support security operations, legal action, executive decision-making, or public attribution.

Estimative Probability Reference

Kent argued that estimative words should not be left to normal conversational ambiguity. Different organizations use different probability bands, but a CTI team should publish and reuse one internal lexicon. A simple working version is:

Probability is not confidence. “Likely” says how probable the judgment is. “Moderate confidence” says how strong the evidentiary basis is.

These bands are illustrative, not universal; the important control is consistency inside the publishing team.

What Is Sherman Kent-Style Analytic Discipline?

Kent-style analytic discipline can be reduced to a practical standard: intelligence analysis should help decision-makers reason under uncertainty without hiding the uncertainty. The analyst’s job is not to sound certain. The analyst’s job is to make evidence, assumptions, probability, confidence, alternatives, and collection gaps visible enough that decision-makers understand the basis and limits of the judgment.

In practice, that means:

1. Serve the decision, not the preference: Intelligence should be relevant to policy or defensive decisions, but analytic judgment should not be shaped to support a preferred outcome.
2. Separate facts from estimates: The analyst should distinguish observed evidence from assumptions, inference, and judgment.
3. Use estimative language deliberately: Words such as “likely,” “probably,” “possible,” and “almost certainly” should communicate probability consistently rather than act as vague hedges.
4. State confidence separately from probability: A judgment can be likely but low confidence if evidence is thin. A judgment can be high confidence but still not certain.
5. Expose assumptions and alternatives: Analysts should test what else could explain the same evidence.
6. Identify collection gaps: A good estimate says what is missing, not only what is believed.
7. Preserve analytic integrity: Intelligence should be candid about uncertainty, source weakness, and dissent.

This is not a mechanical checklist. It is a writing and reasoning discipline: structure the product so the reader can audit the analytic path.

What Maps From Traditional Intelligence to CTI — And What Does Not

Traditional national-security intelligence and CTI share the same analytic problem: decisions must be made before evidence is complete. Kent-style discipline maps well to CTI in several areas:

• Estimative language: CTI needs disciplined wording for attribution, intent, targeting, capability, and likelihood of future activity.
• Source access: CTI must distinguish endpoint telemetry, network logs, malware samples, sinkhole data, victim reporting, vendor clustering, government statements, and media summaries.
• Confidence: CTI must explain whether confidence comes from direct artifacts, multiple independent sources, long-term tracking, or inference.
• Alternative hypotheses: CTI must test whether shared infrastructure means same actor, whether victimology means deliberate targeting, and whether malware behavior proves intent.
• Collection gaps: CTI should turn uncertainty into hunt tasks, telemetry requirements, malware-analysis questions, and intelligence requirements.

But not everything transfers cleanly:

• CTI evidence is often technical and perishable: Domains, infrastructure, certificates, hashes, and telemetry can age quickly.
• Vendor labels are not legal attribution: NOBELIUM, APT29, COZY BEAR, and other labels may overlap, but they are not automatically interchangeable.
• Visibility is uneven: One vendor may see endpoint telemetry, another may see cloud logs, and a government source may have classified access unavailable to public readers.
• Intent is harder than behavior: Malware execution, credential theft, and lateral movement can be documented technically. Strategic objective usually requires assessment.
• A CTI report needs a scoped question: This article is a tradecraft guide. A real CTI report would need a PIR, key judgments, actor or campaign scope, timeline, source base, indicators, affected victims or sectors, confidence per judgment, and defensive implications.

1. Policy Relevance Without Policy Capture

Kent argued for intelligence that mattered to national decisions. Relevance does not mean advocacy. In CTI terms, the analyst should understand the decision context — patch prioritization, detection engineering, executive risk, incident response, threat hunting, vendor exposure, or public communication — without forcing the evidence to support a preferred action.

Example 1: Cuban Missile Crisis imagery supported decision-making without replacing policy judgment

• Claim: October 1962 imagery narrowed uncertainty about Soviet offensive missile deployment in Cuba, but did not determine the U.S. policy response.
• Evidence: U.S. historical records describe a U-2 flight on October 14, 1962 and subsequent photo interpretation that identified Soviet MRBM sites under construction.
• Source access: Official historical records and archival imagery; reported in U.S. government records, not author-observed here.
• Assessment: This is a strong national-security example of policy-relevant intelligence: evidence clarified the threat, while the response remained a policy decision.
• Confidence in assessment: High.
• Confidence basis: Source access: official records and archival imagery; Source reliability: established; Information credibility: corroborated; Author verification: public records checked, original imagery not independently analyzed here.
• Sources: Office of the Historian, FRUS chronology; National Archives, Aerial Photograph of Missiles in Cuba.
• Qualifier / limitation: This is not a CTI case. It is used because the evidence-to-decision structure is directly relevant to CTI reporting.

The CTI translation is straightforward: a malware sample, intrusion timeline, or cloud log can narrow uncertainty, but it does not automatically decide whether the organization should disclose publicly, isolate a business unit, attribute the incident, or notify regulators.

Example 2: The 2007 Iran NIE decomposed a broad question into narrower judgments

• Claim: The 2007 Iran NIE separated several analytic questions — weaponization, enrichment, intent, and future capability — instead of treating “Iran’s nuclear program” as one indivisible judgment.
• Evidence: The declassified NIE uses differentiated judgments and confidence levels across related nuclear questions.
• Source access: Public declassified key judgments; reported by ODNI, not author-observed classified sourcing.
• Assessment: The product is a useful example of decomposing a broad question into narrower estimative judgments.
• Confidence in assessment: High for the decomposition claim; low for any claim about policy effect unless separately sourced.
• Confidence basis: Source access: declassified ODNI key judgments; Source reliability: established; Information credibility: primary public document; Author verification: public text checked, classified sourcing not available.
• Sources: ODNI, Iran: Nuclear Intentions and Capabilities; CIA CSI, 2007 NIE on Iran.
• Qualifier / limitation: This article does not assess whether the NIE changed policy. It only uses the public product to show disciplined decomposition of judgments.

2. Facts, Assumptions, and Judgments

Kent-style analysis requires a visible boundary between what the analyst knows and what the analyst concludes. The most dangerous failures often occur when assumptions are written as if they are evidence.

Example 1: Iraq WMD analysis shows the risk of assumption-driven certainty

• Claim: The Iraq WMD case is a negative example of insufficiently disciplined separation between evidence, assumptions, and judgment.
• Evidence: The WMD Commission identified weak collection, analytic errors, and failure to make clear how much analysis rested on assumptions rather than strong evidence.
• Source access: Official retrospective commission reporting; reported, not author-observed original intelligence.
• Assessment: The Kent-style lesson is that historical behavior and concealment indicators should not be converted into current capability judgments without showing the inference chain.
• Confidence in assessment: High for the official finding of intelligence failure; moderate for the article’s specific “assumption-driven certainty” framing.
• Confidence basis: Source access: official retrospective commission reporting; Source reliability: established; Information credibility: corroborated for broad failure, interpreted for this article’s lesson framing; Author verification: public report checked, original intelligence not available.
• Sources: WMD Commission report index; WMD Commission transmittal letter; GPO WMD Commission PDF.
• Qualifier / limitation: The Iraq case is not a CTI case. It is included because it is a canonical warning about assumptions, source weakness, and overconfident estimates.

Correct Kent-style wording would separate:

• Reported: Iraq had historical WMD programs and had previously concealed activity.
• Reported: sources and technical indicators were interpreted as suggesting renewed activity.
• Assumed: past concealment behavior implied possible continuing programs.
• Assessed: Iraq retained or reconstituted WMD capabilities.
• Collection gap: direct, reliable access to current program status was limited.

The failure mode is converting “the regime has concealed WMD before” into “the regime currently has active WMD programs” without making the inferential jump visible enough.

Example 2: SolarWinds analysis required separating technical fact from attribution judgment

• Claim: SolarWinds reporting should distinguish technical supply-chain compromise from actor attribution and strategic intent.
• Evidence: CISA reported malicious code inserted into the SolarWinds software lifecycle; CrowdStrike analyzed SUNSPOT’s role in manipulating the build process.
• Source access: CISA-reported government advisory and CrowdStrike-reported technical analysis; not author-observed here.
• Assessment: The technical compromise, vendor cluster labels, government attribution, and intent assessment should be written as separate claims.
• Confidence in assessment: High.
• Confidence basis: Source access: government advisory and vendor technical analysis; Source reliability: established; Information credibility: corroborated for supply-chain compromise; Author verification: public reports checked, no independent reverse engineering here.
• Sources: CISA AA20–352A; CrowdStrike, SUNSPOT.
• Qualifier / limitation: Public reporting can support strong technical conclusions while still leaving parts of attribution and intent dependent on non-public evidence.

Kent-style separation:

• Technical behavior: malicious Orion component inserted into build/update lifecycle.
• Tooling: SUNSPOT and SUNBURST.
• Vendor/government label: NOBELIUM, StellarParticle, APT29-style community labels depending on source.
• Attribution: assessed responsibility by governments or vendors.
• Intent: assessed intelligence collection or access objective.

3. Estimative Probability Language

Kent’s “Words of Estimative Probability” addressed a persistent intelligence problem: analysts use words like “possible,” “probable,” and “likely,” but readers may assign different probabilities to the same words. This discipline does not require every estimate to become a math problem. It requires that probability language be intentional and consistent.

Example 1: APT28 attribution should preserve source confidence

• Claim: Public APT28 attribution language should preserve the source’s estimative wording.
• Evidence: The linked Google Cloud/Mandiant blog says FireEye assessed APT28 was most likely sponsored by the Russian government and targeted information useful to government interests. Older or fuller Mandiant/FireEye reporting may use different confidence phrasing, so analysts should preserve the exact wording of the specific source they cite.
• Source access: Vendor reporting based on proprietary analysis; exact source base not fully available to public readers.
• Assessment: “The cited Google Cloud/Mandiant blog says FireEye assessed APT28 was most likely sponsored by the Russian government” is stronger tradecraft than writing “APT28 is proven to be Russia.”
• Confidence in assessment: High for the wording recommendation; moderate for public evaluation of the underlying sponsorship claim.
• Confidence basis: Source access: vendor reporting based on proprietary analysis; Source reliability: established vendor; Information credibility: credible but not fully public; Author verification: linked blog wording checked, underlying evidence not independently verified.
• Source: Google Cloud / Mandiant, APT28.
• Qualifier / limitation: Vendor attribution can be credible without being fully independently auditable from public evidence.

Kent-style wording:

• Better: “The cited Google Cloud/Mandiant blog says FireEye assessed APT28 was most likely sponsored by the Russian government.”
• Weaker: “APT28 is Russian government-directed.”
• Worse: “APT28 is proven to be Russia.”

The first version preserves the source, the estimative term, and the fact that the statement is an assessment.

Example 2: 2007 Iran NIE showed probability and confidence in the same product

• Claim: The 2007 Iran NIE is a useful example of stating confidence levels across separate judgments.
• Evidence: The declassified NIE differentiates judgments about halted weaponization, enrichment, intent, and future decisions.
• Source access: Public declassified key judgments; original classified evidence not available here.
• Assessment: The product demonstrates why broad topics should be decomposed into narrower estimates with separate uncertainty.
• Confidence in assessment: High.
• Confidence basis: Source access: declassified ODNI key judgments; Source reliability: established; Information credibility: primary public document; Author verification: public text checked, classified sourcing not available.
• Source: ODNI, Iran NIE.
• Qualifier / limitation: Confidence language is not a guarantee of truth. It is a statement about evidentiary strength and analytic basis at the time of the estimate.

4. Confidence Is Not Probability

Probability answers: “How likely is the judgment?” Confidence answers: “How strong is the basis for the judgment?” Analysts often blur these together. Kent-style discipline keeps them separate.

Example 1: Iraq WMD showed that high-confidence judgments can still be wrong

• Claim: High confidence does not guarantee analytic accuracy if the source base and assumptions are weak.
• Evidence: Official retrospective reporting found major problems in prewar Iraq WMD assessments, including unsupported or overstated judgments.
• Source access: Official retrospective investigations and public reporting.
• Assessment: The case shows why confidence statements must identify source quality, access, corroboration, and assumption sensitivity.
• Confidence in assessment: High.
• Confidence basis: Source access: official retrospective investigations; Source reliability: established; Information credibility: corroborated for failure finding; Author verification: public reports checked, original intelligence not available.
• Sources: WMD Commission report; Senate Select Committee conclusions via GlobalSecurity mirror.
• Qualifier / limitation: This does not mean confidence language is useless. It means confidence must be earned and explained.

Kent-style analysts should ask:

• What are the strongest sources?
• Which sources are single points of failure?
• What assumptions connect the evidence to the judgment?
• What reporting contradicts the judgment?
• What evidence would reduce confidence?

Example 2: CTI malware behavior can be high confidence while intent remains moderate confidence

• Claim: A CTI product can have high confidence in technical behavior and lower confidence in actor intent.
• Evidence: Mandiant reporting ties WannaCry to SMBv1/TCP 445 propagation and EternalBlue/MS17–010 exploitation. The U.S. Department of Justice later alleged that a North Korean regime-backed programmer connected to Lazarus Group activity participated in creating the malware used in the WannaCry 2.0 attack.
• Source access: Mandiant malware analysis reported technical behavior; DOJ charged/alleged DPRK-linked involvement and provided public attribution material; not author-observed here.
• Assessment: Analysts should assign separate confidence to malware behavior, actor clustering, government attribution, and intent. Government attribution does not remove the need to distinguish technical behavior from strategic motivation.
• Confidence in assessment: High.
• Confidence basis: Source access: Mandiant malware analysis and DOJ charging/public attribution material; Source reliability: established; Information credibility: high for SMB/MS17–010 behavior, established public government attribution exists, inferred for intent and internal tasking; Author verification: public reporting checked, no independent malware analysis here.
• Sources: Mandiant, WannaCry malware profile; Mandiant, WannaCry use of EternalBlue; DOJ, North Korean regime-backed programmer charged.
• Qualifier / limitation: This article does not independently adjudicate the DPRK/Lazarus attribution. It uses the case to show how post-attribution CTI should still separate behavior, attribution, and intent.

5. Alternative Hypotheses

Kent-style analysis does not require analysts to treat all hypotheses as equally plausible. It does require analysts to ask what else could explain the evidence and what collection would discriminate between explanations.

Example 1: 9/11 warning failure showed the cost of narrow imagination

• Claim: The 9/11 case illustrates why warning analysis needs alternative hypotheses before a threat becomes obvious in hindsight.
• Evidence: The 9/11 Commission identified failures of imagination, policy, capabilities, and management.
• Source access: Official retrospective commission reporting.
• Assessment: A warning product should test competing explanations for fragmentary indicators, including low-frequency but high-impact possibilities.
• Confidence in assessment: High for the broad warning lesson; moderate for any reconstructed pre-attack hypothesis set.
• Confidence basis: Source access: official retrospective commission reporting; Source reliability: established; Information credibility: corroborated for broad failure categories, illustrative for reconstructed hypotheses; Author verification: public report checked.
• Sources: 9/11 Commission Report PDF; Office of Justice Programs summary.
• Qualifier / limitation: Hindsight makes patterns look cleaner than they appeared at the time. The goal is humility and better warning structure, not retrospective certainty.

Possible analytic frame before the attack:

• H1: Al-Qaida intended overseas attacks against U.S. interests.
• H2: Al-Qaida intended a major attack inside the United States.
• H3: Al-Qaida intended aviation-related operations, but the exact target and method were unknown.
• Discrimination: travel patterns, flight training, visa anomalies, financial movement, communications, and detainee reporting could have been evaluated as indicators across hypotheses.

Example 2: NotPetya intent remains an assessed judgment

• Claim: NotPetya’s destructive effect is easier to establish publicly than the operators’ internal intent.
• Evidence: Microsoft reported destructive behavior and enterprise spread; Cisco Talos reported M.E.Doc infrastructure manipulation connected to the outbreak. The UK and U.S. governments publicly attributed NotPetya to the Russian government or Russian military in February 2018, and DOJ later charged GRU Unit 74455 officers in connection with NotPetya and other destructive operations.
• Source access: Vendor technical analysis, incident reporting, and public government attribution statements.
• Assessment: Destructive effect should be reported separately from strategic intent even after public government attribution exists.
• Confidence in assessment: High for destructive effect; moderate for specific intent claims.
• Confidence basis: Source access: vendor technical reporting and government attribution statements; Source reliability: established; Information credibility: corroborated for destructive effect, public attribution strengthens actor context, internal intent remains inferred; Author verification: public reports checked, no original telemetry review.
• Sources: Microsoft, NotPetya technical analysis; Cisco Talos, The MeDoc Connection; UK Government, Foreign Office Minister condemns Russia for NotPetya; White House, Statement from the Press Secretary; DOJ, Six Russian GRU officers charged.
• Qualifier / limitation: Public attribution strengthens the actor context, but it still does not expose every internal objective, command decision, or intended propagation boundary.

Alternative hypotheses:

• H1: NotPetya was designed as a destructive state operation using ransomware aesthetics as cover.
• H2: NotPetya was designed primarily for Ukraine-focused disruption but propagated more broadly than intended.
• H3: The ransomware presentation reflected mixed objectives or operational cover rather than a pure financial motive.

The evidence strongly supports destructive effect. It does not publicly prove the internal decision process behind the operation.

6. Warning, Indicators, and Collection Gaps

Kent-style analysis is not only retrospective. It should produce warning questions and collection requirements. A judgment with no collection gap is often a judgment that has not been examined carefully enough.

Example 1: Cuban Missile Crisis warning depended on collection timing and imagery interpretation

• Claim: The Cuban Missile Crisis shows how warning changes as collection improves.
• Evidence: Official records describe the October 14, 1962 U-2 mission, subsequent photo interpretation, and identification of MRBM sites under construction.
• Source access: Official records and imagery references.
• Assessment: Before imagery confirmation, the problem was warning under uncertainty; after imagery, the problem became site status, operational timeline, Soviet intent, and escalation risk.
• Confidence in assessment: High.
• Confidence basis: Source access: official records and imagery references; Source reliability: established; Information credibility: corroborated; Author verification: public records checked.
• Sources: Office of the Historian, FRUS chronology; DIA photo record.
• Qualifier / limitation: This is a national-security warning example, not a CTI intrusion case.

Kent-style warning questions:

• What indicators would show offensive missile deployment rather than defensive military aid?
• What collection confirms construction status?
• What evidence distinguishes operational missiles from support equipment?
• What is the time horizon before the threat becomes operational?
• What assumptions could cause overreaction or underreaction?

Example 2: SolarWinds exposed a collection gap in trusted software supply chains

• Claim: SolarWinds showed that trusted software updates can create visibility gaps not solved by ordinary IOC matching.
• Evidence: CISA and CrowdStrike reporting describe malicious code inserted into a trusted software build and update process.
• Source access: Government advisory and vendor technical analysis.
• Assessment: The collection gap included build integrity, signed software provenance, vendor trust relationships, and anomalous post-update behavior.
• Confidence in assessment: High for the SolarWinds-specific gap; moderate for generalizing across all software supply-chain risk.
• Confidence basis: Source access: government advisory and vendor technical analysis; Source reliability: established; Information credibility: corroborated for SolarWinds compromise mechanism, inferred for broader supply-chain lessons; Author verification: public reports checked.
• Sources: CISA AA20–352A; CrowdStrike, SUNSPOT.
• Qualifier / limitation: A supply-chain compromise does not imply every similar vendor relationship is equally exposed.

7. Analytic Integrity in CTI

CTI reporting often mixes telemetry, malware family names, vendor clusters, infrastructure, attribution, and intent. Analytic integrity means refusing to compress those into a single confident story unless the evidence supports it.

Example 1: APT1 victimology supports targeting assessment, not observed reconnaissance

• Claim: APT1 victimology supports a target-selection assessment, but does not directly prove specific reconnaissance methods.
• Evidence: Mandiant reported that APT1 compromised at least 141 organizations across many industries and tied the victimology to Chinese strategic priorities.
• Source access: Vendor incident response and technical reporting; public readers do not see the full underlying evidence.
• Assessment: Victimology supports deliberate campaign-level targeting, while individual intrusion reconnaissance remains a collection gap unless separate evidence exists.
• Confidence in assessment: Moderate.
• Confidence basis: Source access: vendor incident response reporting; Source reliability: established vendor; Information credibility: credible but limited public raw data; Author verification: public report checked, underlying case data not available.
• Source: Mandiant, APT1 report.
• Qualifier / limitation: Victimology alignment is not proof of tasking or pre-compromise research for each victim.

Kent-style wording:

• Reported: APT1 compromised a large victim set across multiple sectors.
• Assessed by source: Victim sectors aligned with strategic economic and policy interests.
• Inferred by this article: The campaign likely involved deliberate target selection.
• Collection gap: The exact reconnaissance method before each intrusion is not directly shown by victimology alone.

Example 2: SUNBURST, GoldMax, Sibot, and StellarParticle should not be flattened into one label

• Claim: SolarWinds-related reporting requires careful separation of malware, tools, vendor clusters, campaign names, attribution, and intent.
• Evidence: Microsoft described GoldMax, GoldFinder, and Sibot as later-stage NOBELIUM tools; CrowdStrike used StellarParticle for related follow-on intrusion activity.
• Source access: Vendor technical analysis based on proprietary telemetry and incident response.
• Assessment: Treating SUNBURST, SUNSPOT, GoldMax, Sibot, NOBELIUM, StellarParticle, APT29, and COZY BEAR as interchangeable would collapse different analytic layers.
• Confidence in assessment: High.
• Confidence basis: Source access: vendor technical reporting; Source reliability: established vendors; Information credibility: credible and label-specific; Author verification: public reports checked, cross-vendor clustering not independently verified.
• Sources: Microsoft, GoldMax, GoldFinder, and Sibot; CrowdStrike, StellarParticle observations.
• Qualifier / limitation: Cross-vendor clustering may be valid, but it should be stated as an assessment with evidence, not assumed from name proximity.

Kent-style separation:

• Malware/tool: SUNBURST, SUNSPOT, GoldMax, GoldFinder, Sibot.
• Vendor cluster: NOBELIUM, StellarParticle, APT29-style community labels.
• Campaign: SolarWinds-related intrusion activity.
• Attribution: assessed state-linked responsibility.
• Intent: intelligence collection, access development, or other objectives.

Cognitive Biases CTI Analysts Should Name

Kent-style discipline is partly about fighting predictable analytic failure modes. The CIA tradecraft primer emphasizes structured techniques because analysts working with incomplete and ambiguous information are vulnerable to cognitive bias (CIA, A Tradecraft Primer).

Common CTI bias patterns:

• Confirmation bias: treating every new domain, malware string, or infrastructure overlap as support for the actor hypothesis already in the analyst’s head.
• Anchoring: giving too much weight to the first vendor label or first incident-response theory, even after better evidence appears.
• Mirror imaging: assuming the adversary values risk, cost, publicity, or operational tempo the same way the defender does.
• Availability bias: over-weighting the most recent high-profile campaign because it is memorable, not because it best explains the evidence.
• Groupthink: converging on a shared attribution label because peer teams or trusted vendors use it, without separately testing the underlying evidence.

Structured analytic techniques are useful because they force friction into the analysis. Alternative hypotheses, key assumptions checks, evidence matrices, and premortems are not bureaucratic decoration; they are bias controls. In CTI, the most practical bias check is simple: before publishing an attribution, write down the strongest evidence against it.

Where ATT&CK and the Pyramid of Pain Fit

MITRE ATT&CK gives CTI teams a structured vocabulary for adversary tactics and techniques based on real-world observations (MITRE ATT&CK). The Pyramid of Pain, associated with David Bianco, explains why higher-level behavioral indicators and TTPs are usually harder for adversaries to change than hashes, IPs, and domains.

Kent-style discipline does not replace these frameworks. It tells analysts how to write about them:

• Hash, IP, domain: usually source-observed or reported technical indicators; useful but often perishable and weak for attribution.
• Host or network artifact: stronger than a raw IOC when tied to execution context, but still may not identify an actor.
• ATT&CK technique: a behavioral claim. It should be mapped only when evidence supports the behavior, not because a malware family is commonly associated with the technique.
• Tool: stronger than a hash when supported by reverse engineering, but tool reuse and leaks can complicate attribution.
• TTP pattern: stronger for clustering when repeated across time, victims, infrastructure, and tooling.
• Actor attribution and intent: assessed judgments. ATT&CK mapping can support them, but does not prove them by itself.

Example: “The intrusion used credential dumping” is a technique-level claim. “This was APT28” is an attribution claim. “The objective was strategic intelligence collection” is an intent claim. They need different evidence and different confidence statements.

Kent-Style Checklist

Use this checklist before publishing an analytic judgment:

1. Question: What decision or intelligence requirement does this answer?
2. Claim: What exactly are you asserting?
3. Evidence: What is source-observed, reported, assessed, or inferred?
4. Source access: Did the source have telemetry, malware samples, logs, imagery, victim access, official records, or secondhand reporting?
5. Source reliability: Is the source established, unknown, contested, or mixed?
6. Information credibility: Is the information corroborated, single-source, inferred, or disputed?
7. Author verification: What did you personally verify?
8. Assumptions: What must be true for the judgment to hold?
9. Probability: How likely is the judgment?
10. Confidence: How strong is the evidence base?
11. Alternatives: What else could explain the same evidence?
12. Discrimination: What evidence would separate the hypotheses?
13. Gaps: What do we still not know?
14. Dissent: Are there credible disagreements or minority views?
15. Change indicators: What would cause the assessment to change?

Practical Analyst Template

Product title:
Primary intelligence requirement:
Decision context:
Analyst:
Date:
Bottom line:
- Assessment:
- Probability language:
- Confidence:
- Scope and time horizon:
Claim:
- Exact claim:
- What this claim does not say:
Evidence base:
- Author-observed:
- Source-observed:
- Reported:
- Assessed by source:
- Inferred by analyst:
Source quality:
- Source access:
- Source reliability:
- Information credibility:
- Corroboration:
- Author verification:
Assumptions:
- Assumption 1:
- Assumption 2:
- Assumption sensitivity:
Alternative hypotheses:
- H1 (primary):
- H2 (alternative):
- H3 (alternative, if needed):
- Discriminating evidence:
- Current preferred hypothesis and why:
Confidence basis:
- Collection strength:
- Collection weakness:
- Analytic uncertainty:
- Dissent or caveats:
Collection requirements:
- Requirement 1:
- Requirement 2:
- Requirement 3:
Indicators to watch:
- Indicator that would increase confidence:
- Indicator that would decrease confidence:
- Indicator that would change the assessment:
Defensive or policy implications:
- Tactical:
- Operational:
- Strategic:

Conclusion

Sherman Kent’s analytic legacy is not a historical curiosity. It is a practical discipline for writing intelligence under uncertainty. For CTI analysts, the lesson is especially important because cyber reporting routinely combines artifacts, telemetry, malware names, infrastructure links, vendor clusters, government statements, victimology, attribution, and intent.

The real-world examples show why the discipline matters:

• Cuban Missile Crisis imagery shows policy-relevant intelligence narrowing uncertainty without replacing policy judgment.
• Iraq WMD analysis shows the danger of converting assumptions into confident conclusions.
• The 2007 Iran NIE shows the value of decomposing a broad issue into separate judgments with separate confidence levels.
• 9/11 warning analysis shows why alternative hypotheses matter before a threat is obvious.
• SolarWinds shows why CTI must separate technical fact, tooling, vendor labels, attribution, and intent.
• APT1 victimology shows how to infer target selection without pretending to observe reconnaissance.
• NotPetya shows why destructive effect and strategic intent must be assessed separately.

Used this way, Kent-style analytic discipline helps CTI analysts produce clearer estimates, better collection requirements, more defensible confidence statements, and fewer overclaims.

References

• CIA, Sherman Kent, Words of Estimative Probability: https://www.cia.gov/resources/csi/studies-in-intelligence/archives/vol-8-no-4/words-of-estimative-probability/
• CIA, Words of Estimative Probability PDF: https://www.cia.gov/resources/csi/static/Words-of-Estimative-Probability.pdf
• CIA, The Intelligence Process: A Digest from Strategic Intelligence by Sherman Kent: https://www.cia.gov/readingroom/document/cia-rdp78-04718a000600100003-3
• CIA, Sherman Kent and the Profession of Intelligence Analysis: https://www.cia.gov/resources/csi/static/Kent-Profession-Intel-Analysis.pdf
• ODNI, Intelligence Community Directive 203: Analytic Standards: https://www.dni.gov/files/documents/ICD/ICD-203.pdf
• CIA, A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis: https://www.cia.gov/resources/csi/static/Tradecraft-Primer-apr09.pdf
• Office of the Historian, Cuban Missile Crisis chronology and U-2 collection: https://history.state.gov/historicaldocuments/frus1961-63v11/d16
• National Archives, Aerial Photograph of Missiles in Cuba: https://www.archives.gov/milestone-documents/aerial-photograph-of-missiles-in-cuba
• DIA, Cuban Missile Crisis U-2 photo record: https://www.dia.mil/News-Features/Photo-Gallery/igphoto/2000948884/
• WMD Commission report index: https://govinfo.library.unt.edu/wmd/report/index.html
• WMD Commission report PDF: https://www.govinfo.gov/content/pkg/GPO-WMD/pdf/GPO-WMD.pdf
• WMD Commission transmittal letter: https://govinfo.library.unt.edu/wmd/report/transmittal_letter.html
• Senate Select Committee conclusions on Iraq WMD intelligence via GlobalSecurity mirror: https://www.globalsecurity.org/intell/library/congress/2004_rpt/iraq-wmd_intell_09jul2004_conclusions.htm
• 9/11 Commission Report PDF: https://www.9-11commission.gov/report/911Report.pdf
• Office of Justice Programs, 9/11 Commission Report summary: https://www.ojp.gov/ncjrs/virtual-library/abstracts/911-commission-report-executive-summary
• ODNI, Iran: Nuclear Intentions and Capabilities, 2007 NIE: https://www.dni.gov/files/documents/Newsroom/Reports%20and%20Pubs/20071203_release.pdf
• CIA CSI, CIA Support to Policymakers: The 2007 NIE on Iran’s Nuclear Intentions and Capabilities: https://www.cia.gov/resources/csi/books-monographs/cia-support-to-policymakers-the-2007-nie-on-irans-nuclear-intentions-and-capabilities/
• Mandiant, APT1: https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf
• Google Cloud / Mandiant, APT28: https://cloud.google.com/blog/topics/threat-intelligence/apt28-a-window-into-russias-cyber-espionage-operations
• CISA, SolarWinds AA20–352A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a
• CrowdStrike, SUNSPOT: https://www.crowdstrike.com/en-us/blog/sunspot-malware-technical-analysis/
• Microsoft, GoldMax, GoldFinder, and Sibot: https://www.microsoft.com/en-us/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
• CrowdStrike, StellarParticle observations: https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/
• MITRE ATT&CK: https://attack.mitre.org/
• MITRE, MITRE ATT&CK overview: https://www.mitre.org/focus-areas/cybersecurity/mitre-attack
• Sqrrl / David Bianco, A Framework for Cyber Threat Hunting Part 1: The Pyramid of Pain: https://www.threathunting.net/files/A%20Framework%20for%20Cyber%20Threat%20Hunting%20Part%201_%20The%20Pyramid%20of%20Pain%20_%20Sqrrl.pdf
• Mandiant, WannaCry malware profile: https://cloud.google.com/blog/topics/threat-intelligence/wannacry-malware-profile
• Mandiant, WannaCry use of EternalBlue: https://cloud.google.com/blog/topics/threat-intelligence/smb-exploited-wannacry-use-of-eternalblue/
• DOJ, North Korean regime-backed programmer charged in cyber attacks including WannaCry 2.0: https://www.justice.gov/archives/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and
• Microsoft, NotPetya technical analysis: https://www.microsoft.com/security/blog/2017/10/03/advanced-threat-analytics-security-research-network-technical-analysis-notpetya/
• Cisco Talos, The MeDoc Connection: https://blogs.cisco.com/security/talos/the-medoc-connection
• UK Government, Foreign Office Minister condemns Russia for NotPetya attacks: https://www.gov.uk/government/news/foreign-office-minister-condemns-russia-for-notpetya-attacks
• White House, Statement from the Press Secretary on NotPetya: https://trumpwhitehouse.archives.gov/briefings-statements/statement-press-secretary-25/
• DOJ, Six Russian GRU officers charged in connection with destructive malware including NotPetya: https://www.justice.gov/opa/pr/six-russian-gru-officers-charged-connection-worldwide-deployment-destructive-malware-and

Follow for practical cybersecurity research

If you’re interested in Offensive security, AI security, real-world attack simulations, CTI, and detection engineering — this is exactly what I focus on.

Stay connected:

→ Subscribe on Medium: medium.com/@1200km
→ Connect on LinkedIn: andrey-pautov
→ GitHub — tools & labs: github.com/anpa1200
→ Contact: 1200km@gmail.com

Andrey Pautov

Applying Sherman Kent’s Analytic Discipline to CTI: A Practical Analyst Guide was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Read more of this story at Slashdot.

Large banks are exploring “tokenized deposits” as a way to modernize banking infrastructure without converting customer funds into cryptocurrency. Instead of placing money directly on-chain, the blockchain can act as a record layer that references deposits still held inside the conventional banking system.

This approach could let banks benefit from blockchain-based settlement and transfer systems while avoiding the disintermediation associated with decentralized crypto networks. In practice, it preserves existing banking structures while adopting newer transaction rails underneath.

If banks use blockchain technology but keep deposits fully inside the traditional financial system, is that genuine financial innovation — or simply legacy banking with upgraded infrastructure?

Subscribe to our podcasts: https://securityweekly.com/subscribe

#Blockchain #Banking #FinTech #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec