Tag: TaHiTI
Newly-Registered Domains & DGA Infrastructure in Q3 2026 — 5.63M New Domains, 660K DGA-Pattern Clusters, Four-Dimensional Hunt + TaHiTI Playbook
The Q3 2026 Domain Infrastructure Report decomposes 7.88 million domain IOCs across four hunt dimensions: newly-registered (71% of the stream), TLD-abuse divergence (40x .xyz surge July to August), DGA-pattern (660K structural matches across four buckets), and brand-lookalike (14 vendor families, 20K+ domains). Includes top-10 per type, named operator attribution (ClearFake, Lucid, IClickFix, UNC1549, UNC6671, UTA0560, BlueNoroff), the TaHiTI framework applied in practice with three run-sheets, a TMM maturity-model lens, and a 90-day deployment plan. Published to /category/cyber-threat-intelligence/.
Weekly Threat Advisory: The Burn-Out Week — Ransomware Collapsed 36 → 2, Botnet Infrastructure Surged, APT Showing Recovery (Sept 28 – Oct 4, 2026)
The burn-out week. Ransomware operators collapsed 94% in seven days (36 → 2) as the new-affiliate cohort completed its deployment phase. Two Mozi-class botnet operators produced 1,169 indicators in a parallel infrastructure build event. 19 malware families produced the largest Malware-tier reading of the trailing 8 weeks. APT concurrency ticked up (4 → 5) — early recovery signal. 4,812 attributed IOCs. 51 named adversaries. 19 distinct MITRE TTPs. Full CISO briefing with 4 Sigma rules, top 60 IOCs, risk-register wording.
Weekly Threat Advisory: The Pivot Week — Persistent C2 Operator Went Silent, Ransomware Surge Arrived Early, APT Cycle-End Confirmed (Sept 21-27, 2026)
The pivot week. The three-week persistent C2 operator surfaced zero attributable indicators. The ransomware surge we forecast for Weeks 40-42 arrived one week early at 37 concurrent operators (208% jump). APT concurrency collapsed to 4 clusters, confirming cycle-end. Malware distribution surface exploded with three concentrated Loader/RAT/Trojan clusters. Full CISO briefing with 4 Sigma rules, top 60 IOCs, risk-register wording.
Weekly Threat Advisory: Consolidation Week — 8 APT Clusters (Down 75%), Ransomware Collapse (Down 97%), But Persistent C2 Operator Enters Week 3 (Sept 14-20, 2026)
Consolidation week. APT concurrency dropped 75% (33 → 8). Ransomware volume collapsed 97% (540 → 16). Distinct MITRE TTPs narrowed 69% (54 → 17). But the persistent C2 operator continued into a third consecutive week at 45,298 IOCs. 48,948 unique high-confidence indicators. 65 tracked clusters. Full CISO briefing with 4 Sigma rules, top 60 IOCs, risk-register wording, cross-week trend.
The TaHiTI Maturity Doctrine · 5 Levels of Hunt-Program Maturity, a CISO Self-Assessment, and a 90-Day Playbook to Reach Level 3+
Coining Hunt-Debt. 5-level TaHiTI Maturity Model (L1 Reactive → L5 Optimized). 30-question CISO Self-Assessment scoring your program out of 90. 90-Day Operator Playbook to move from Level 1/2 to Level 3+. Anti-patterns per level. Sept 2026 threat-surface case study. Risk-register wording ready for ERM paste. Complete Part 4 of the TaHiTI series.
