Skip to content
THE HUNTER’S LEDGER

Original Threat Intelligence Research

Hands-on malware analysis turned into structured, evidence-based intelligence, technically deep enough to trust and clear enough to act on. Free and open: published by a solo analyst for the defender community, with no paywall or signup.

44 Reports 754 Detection Rules 111 ATT&CK Techniques Covered 2793 IOCs 45 STIX Bundles 46 Malware & Tools Profiled 25 Threat Actors Tracked 23 Takedowns & Victim Actions

Takedowns & Victim Actions counts only what was reported back to me; most of my reports get no reply.

Latest Reports
CRITICAL · Oct 2026
Help Desks to Host Shells Across Brazil's Public Sector
Open Dir Toolkit Exploitation Brazil
HIGH · Sep 2026
FACEIT ClickFix Pages Point CS2 Players to a Script URL That VirusTotal Ties to a Steam-Focused Executable
ClickFix Stealer Loader PowerShell
HIGH · Sep 2026
Gotenberg CVE-2026-42589 Mass Exploitation and Cryptomining
Cryptojacking Mass Exploitation CVE-2026-42589 XMRig
HIGH · Sep 2026
Sliver C2 Windows Post-Exploitation Staging, 193.233.202.17
Sliver Post-Ex EtherHiding Blockchain C2

View all reports →

Mission

Most threat intelligence fails defenders in one of two ways. It is either too shallow to be actionable (headlines dressed up as analysis), or technically rigorous but locked behind paywalls, stripped of indicators, and written for researchers rather than the people responding at 2am.

The Hunter's Ledger exists to fill that gap. Every report here is built from original research: real samples, real infrastructure, real detections. The goal is intelligence that a defender can open, read, and act on the same day, with IOCs ready to ingest, detection rules ready to deploy, and analysis deep enough to actually understand what a threat does and how to stop it.

All of it is free. Defenders should not have to pay to defend.

Not a collection of open-source intel reports, IOCs, or TTPs. Findings are from original research, though they may overlap with known threats.
Explore
Reports
In-depth malware analysis & reverse engineering
Detection Library
Sigma, YARA, and Suricata rules
IOC Feeds
Indicators ready for your SIEM or EDR
STIX Bundles
STIX 2.1 bundles for OpenCTI & MISP
Browse the Corpus
Threat Actors
Tracked actors and the evidence behind each
Malware Families
Each family with its reports, rules and feeds
ATT&CK Techniques
Coverage heatmap and a Navigator layer
Takedowns & Victim Actions
What hosts, CERTs and victims did after my reports
Stay Current
The Wire
Headlines from public threat research, every 15 minutes
Changes
Revisions to published reports, newest first
About & Connect
About Me
Background & how to reach me
Behind the Reports
How the intelligence is produced
Consulting
Malware analysis, IR & detection services
Support
Help keep the research free
Have original research, detections, or IOCs to share? Reach out at intel@the-hunters-ledger.com. Findings can be posted on your behalf as a co-author, or attributed however you prefer.