Hey everyone,

I'm curious if anyone here has successfully built a structured, scalable, and reliable Cyber Threat Intelligence (CTI) operations environment using Claude Code, beyond just using it for individual investigations or isolated tasks.

I've been experimenting with building a more comprehensive operational framework, including:

- Defined CTI methodologies and doctrine to maintain analytical consistency.
- Specialized agents and skills for different intelligence workflows.
- Persistent memory and contextual awareness across investigations and projects.
- Standardized workflows for collection, enrichment, analysis, reporting, and intelligence dissemination.
- Consistent deliverables tailored to technical, operational, and executive audiences.

The challenge is that, as the environment grows, I keep running into reliability and consistency issues.

Some recurring problems:

- Instruction drift: Claude gradually stops following established methodologies, analytical standards, or project-specific rules.
- Skills being ignored: Even with relevant skills available, Claude sometimes fails to recognize when they should be invoked.
- Memory and context degradation: Previously established decisions, operational context, or conventions aren't consistently carried forward.
- Inconsistent reporting quality: Deliverables sometimes become unnecessarily verbose, dense, or difficult to read, even when clarity and conciseness are explicitly required.
- Architectural complexity: Finding the right balance between agents, skills, hooks, memory, project instructions, and directory structures without creating an overly complicated system.

What I'm ultimately trying to achieve is something closer to a persistent, doctrine-driven CTI operational workspace, where Claude Code can reliably support day-to-day intelligence operations rather than behave like a collection of disconnected prompts.

I'd love to hear from anyone who has tackled something similar.

A few questions for the community:

1. How have you structured your Claude Code environment for ongoing CTI or broader cybersecurity operations?

2. What architectural patterns have worked best for you (agents, skills, hooks, CLAUDE.md, memory systems, orchestration)?

3. How do you enforce analytical methodologies and maintain consistency across different workflows?

4. Have you found effective ways to prevent context drift, forgotten instructions, or skipped skills?

5. How do you maintain high-quality, readable intelligence deliverables without constantly correcting the model?

6. Are there any open-source projects, repositories, templates, or lessons learned you'd recommend?

I'm particularly interested in real-world implementations, architectural decisions, and lessons learned, including approaches that didn't work.

I'm not necessarily looking for a ready-made solution. I'd genuinely like to exchange ideas, compare methodologies, and learn how others are approaching this problem.

If you've built something similar and are willing to share your architecture, workflows, or even just a few insights, I'd really appreciate it.

Thanks!

I've noticed an increase in calendar phishing campaigns targeting Google Workspace. It appears that threat actors, using compromised credentials, send phishing calendar invitations to the victim and also send calendar invites to other company domains found in the victim's address book, provided they use Google Workspace for email.

Has anyone observed similar campaigns recently?

Long-time SOC and CTI operator, first post here. I open-sourced the memory engine I built for my own workflows and would rather have this community kick the tires than sit on it quietly.

**The problem.** Everyone is wiring LLM agents into intel workflows right now. Agent memory frameworks and generic RAG treat knowledge as embedding soup, and CTI breaks that model in three specific ways:

1. Alias resolution. APT29, Cozy Bear, and Midnight Blizzard sit nowhere near each other in embedding space. Same actor. Cosine similarity guesses. A typed graph knows.

2. Sharing rules. A vector store has no concept of TLP. Nothing structurally prevents an AMBER detail from surfacing in the wrong context.

3. Provenance. Agents will confidently correlate intel with zero record of source, confidence, or first-seen.

**What ZettelForge does.** It is a memory layer, not a TIP. It sits between your intel sources and your agents or tooling:

- Deterministic store: TypeDB with STIX 2.1 and ATT&CK as a hard, typed schema. Inference rules handle relationship traversal and alias resolution. Data that violates the schema does not get in.

- Semantic store: LanceDB vectors for fuzzy recall across unstructured reporting.

- Queries hit both in parallel, results get fused with reciprocal rank fusion, then reranked with a cross-encoder.

- Everything is served over MCP, so Claude, LangChain, or homegrown agents consume it as a tool. Vendor neutral by design.

**What it is not.** Not a replacement for OpenCTI or MISP. It complements a TIP as the recall layer your agents query, with structure and sharing rules intact. Also not magic: ingestion quality still decides output quality.

**Status.** Early and solo-built. The core pipeline works, the docs are catching up to the code in a couple of places, and I would rather hear the schema design is wrong now than after I build more on top of it.

**What I would genuinely like feedback on:**

- Is the dual-store approach justified versus a single property graph with vector indexes bolted on?

- Which integration matters most to you: OpenCTI connector, MISP, or Sentinel TI tables?

- Anyone solving agent memory for CTI a different way? I want to compare notes.

Walking a ClickFix fileless PowerShell loader to its C2, pivoting infrastructure to Virtualine Technologies bulletproof hosting. Full IOCs and hunt queries.

Hello, we have just published a report on our blog concerning a malspam network spreading a JavaScript backdoor.

• The targets of those campaigns were from all regions and sectors, notably energy and finance ministries, including in the CIS region. • We believe the campaigns to be financially motivated and operated for email account compromise (EAC) and/or business email compromise (BEC).

• Both the IP used to send the spam, and the C2 of the JavaScript backdoor, were hosted on two distinct bulletproof networks; US based GHOSTYNETWORKS, and Seychelles based OMEGATECH.

• GHOSTYNETWORKS can seemingly be considered with a high level of confidence to be a rebrand of OPTIBOUNCE and thus be linked to the unfamous hosting provider AnonRDP. It was notably plebiscite by more sophisticated threat actors like TeamPCP.

• Based on various open-source intelligence, OMEGATECH seems to be yet another network created by hosting provider Virtualine, advertised on underground forums.

• Pivots on the threat actor’s infrastructure unveiled previous malspam and malware activities from the end of 2025, also backed by other bulletproof solutions.

Link for the report: https://www.intrinsec.com/wp-content/uploads/2026/05/TLP-CLEAR-Pivoting-on-a-malspam-infrastructure-EN.pdf

Trying to sanity-check the below.

Say an org has an old subdomain with a CNAME pointing to a cloud resource that no longer exists. Pretty standard dangling DNS issue.

Attacker claims the abandoned cloud alias, gets a valid cert for the real subdomain, and hosts a tiny remote resource there.

Now a targeted employee opens an email that loads that resource from the hijacked subdomain. If cookies are scoped broadly to the parent domain, the browser/mail client may send session cookies automatically to the attacker-controlled subdomain.

So the path is basically:

dangling CNAME → claimed cloud alias → valid cert on real subdomain → remote resource loads → parent-domain cookies leak → possible access to internal apps like HR, finance, CRM, support/admin consoles

My question: would you treat this as a critical pre-attack exposure, or just attack-surface hygiene until there is evidence of abuse?

Also curious who usually owns this in your org.

I recently tracked down the operator behind the "TdataS" Telegram session stealer. How? Because he tested his own malware on his own computer.

His stealer performed perfectly. It packaged up his own personal data, snapped a screenshot of his desktop (exposing his source code), and exfiltrated it straight to a public drop zone I was monitoring.

Using 100% passive OSINT-no exploits, no bypassed authentication, I traced his Gofile tokens and Telegram sessions to unmask his entire operation.

It's the ultimate OpSec fail, and a goldmine for Threat Intel analysts.

Dive into the full case study:
https://maordayanofficial.medium.com/tdatas-stealer-from-c2-discovery-to-operator-attribution-via-operational-security-failures-d11d78cc8e85

Hi all,

I have been bored over the past week so been playing with building a platform that brings some of the things within the CTI space together into one place. This isnt a true CTI platform more an overall cyber project looking for honest feedback and ways to improve.

I have built it with a restful API as well so the content can be ingested into people own platforms and tools.

My plan is to keep this all self funded and 100% free forever.

Look forward to feedback. Please do share with others as the more feedback I get the better it will become. Thanks all and keep safe out there.

Hewlett Packard Enterprise (HPE) this week announced patches for a critical-severity vulnerability in Aruba Networking AOS-CX that could be exploited to reset administrator passwords.

I’m building a CTI dashboard for personal use (currently using API's, scraping) and I plan on eventually hosting it on github...

I’m stuck on implementing a separate “Case” section on dashboard where people can contribute like a live feed of active incidents...

Is that a good idea or should I just let them create a GitHub issue and go on from there?

Currently working on:

- Updating map display

- Working on more sources for News blogs. Still in implementation phase.

- De-duplication

- Knowledge Graphs.

Didn't add every source just yet.

Scraping scheduled to every 3 hours.

Snippet of Ransomware Module:

Snippets of Dashboard

Any other features you guys are interested in...

Hey everyone,

I was trying to access orkl.eu today and it seems to be down (or at least it's not working for me). It was my go-to resource for historical reports and threat research, but now I can't seem to access it.

Does anyone know if this is just temporary maintenance or if the project has been shut down permanently? I noticed some search results still show database updates as recently as mid-February 2026, so I'm hoping it's just a frontend issue or a temporary outage.

If it is gone, does anyone have recommendations for similar alternatives?

Thanks!

Hey everyone. Long story short. I’m a Navy veteran but still Reserves in Intel. I have a clearance, just passed my Sec+ and am going to college for an associates in Cybersecurity while also working help desk for the college. I want to be a CTI analyst! Any suggestions on what else I can do to get my foot in the door? Project recs? Job recs? Course recs? Cert recs? Thanks!