Category: Cyber Threat
Newly-Registered Domains & DGA Infrastructure in Q3 2026 — 5.63M New Domains, 660K DGA-Pattern Clusters, Four-Dimensional Hunt + TaHiTI Playbook
The Q3 2026 Domain Infrastructure Report decomposes 7.88 million domain IOCs across four hunt dimensions: newly-registered (71% of the stream), TLD-abuse divergence (40x .xyz surge July to August), DGA-pattern (660K structural matches across four buckets), and brand-lookalike (14 vendor families, 20K+ domains). Includes top-10 per type, named operator attribution (ClearFake, Lucid, IClickFix, UNC1549, UNC6671, UTA0560, BlueNoroff), the TaHiTI framework applied in practice with three run-sheets, a TMM maturity-model lens, and a 90-day deployment plan. Published to /category/cyber-threat-intelligence/.
The TaHiTI Maturity Doctrine · 5 Levels of Hunt-Program Maturity, a CISO Self-Assessment, and a 90-Day Playbook to Reach Level 3+
Coining Hunt-Debt. 5-level TaHiTI Maturity Model (L1 Reactive → L5 Optimized). 30-question CISO Self-Assessment scoring your program out of 90. 90-Day Operator Playbook to move from Level 1/2 to Level 3+. Anti-patterns per level. Sept 2026 threat-surface case study. Risk-register wording ready for ERM paste. Complete Part 4 of the TaHiTI series.
The TaHiTI Finalize Doctrine · Why 90% of Threat Hunting Programs Never Compound (and the 5-Deliverable Playbook That Fixes It)
TaHiTI Part 3. Initialize creates fuel. Hunt burns it. Finalize turns exhaust into tomorrow’s fuel. 90% of hunting programs skip it — which is why they never mature. The 5-deliverable Finalize checklist, the 50-operator backlog governance playbook, four maturity metrics, and three copy-paste handoff templates.
The AIaaS Doctrine · Attack Infrastructure as a Service · What 1.86 Million Cloud-Hosted IOCs Tell Every CISO
Attack Infrastructure as a Service (AIaaS) is coined. 44 threat actors deliberately share one cloud-hosted IP. 76% of persistent adversaries are deliberately diversified. Your allow-list is a target selector. A CISO-grade manifesto with 7 laws, a 10-question scorecard, and a 7-principle defence doctrine.
The TaHiTI Investigation Abstract: Turning Threat Intelligence Into Targeted Hunts
Part 2 of the TaHiTI series. The investigation abstract is the Phase-I artefact that converts a raw threat-intelligence trigger into an executable hunt. This walkthrough covers all five components of the abstract, the five characteristics of a good hypothesis (per the official FI-ISAC methodology), the three anti-patterns that derail hunt programs, and three worked examples that convert this week’s live threat intelligence into methodology-faithful abstracts.
