{"id":54379,"date":"2023-10-31T14:50:00","date_gmt":"2023-10-31T14:50:00","guid":{"rendered":"https:\/\/www.darkreading.com\/cloud\/elektra-leak-attackers-harvest-aws-cloud-keys-github-campaign"},"modified":"2023-10-31T14:50:00","modified_gmt":"2023-10-31T14:50:00","slug":"elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/","title":{"rendered":"‘Elektra-Leak’ Attackers Harvest AWS Cloud Keys in GitHub Campaign"},"content":{"rendered":"
<\/div>\n

Attackers are actively harvesting exposed Amazon Web Services (AWS) identity and access management (IAM) credentials in public GitHub repositories to create AWS Elastic Compute (EC2) instances for cryptocurrency mining purposes.<\/p>\n

Researchers from Palo Alto Networks, who are tracking the campaign as “Elektra-Leak,” said this week that they observed the attacker creating at least 474 unique large-format \u2014 or compute-optimized \u2014 Amazon EC2 instances for crypto-mining just between Aug. 30 and Oct. 6.<\/p>\n

Quick Detection and Abuse<\/h2>\n

In a report this week, the researchers described the campaign as noteworthy for the threat actor’s ability to launch a full-fledged attack within just five minutes of an IAM credential getting exposed<\/a> on a public GitHub repository. The attacker has been able to use exposed keys to create AWS EC2 instances even though Amazon has been successfully implementing its quarantining polices within minutes of exposure to protect against such misuse.<\/p>\n

“Despite successful AWS quarantine policies, the campaign maintains continuous fluctuation in the number and frequency of compromised victim accounts,” Palo Alto researchers William Gamazo and Nathaniel Quist said in a report this week<\/a>. “Several speculations as to why the campaign is still active include that this campaign is not solely focused on exposed GitHub credentials or Amazon EC2 instance targeting.”<\/p>\n

Palo Alto researchers discovered the Elektra-Leak campaign via a honey trap the company implemented for gathering threat intelligence on new and emerging cloud security threats. Their investigation of the campaign showed the threat actor is likely using automated tools to continuously clone public GitHub repositories and to scan them for exposed AWS keys. Many organizations clone their GitHub repositories so that they have a local copy of the repository within their development environment.<\/p>\n

Data from the threat actor’s attacks on Palo Alto’s honeypot showed the adversary scanning public GitHub repositories in real-time from behind a VPN and using exposed AWS keys to conduct reconnaissance on the associated AWS account. After conducting the initial reconnaissance, the Palo Alto researchers found the threat actor using an AWS API to instantiate multiple EC2 instances per region for any AWS region they could access via the account. The attackers then downloaded a payload, stored in Google Drive, for Monero cryptomining.<\/p>\n

Monero’s privacy protections prevented Palo Alto researchers from tracking associated wallets, so it was not possible to obtain any figures on how much cryptocurrency the threat actor has been able to mine so far, the security vendor said. The fact that the adversary is doing the automated scanning from behind a VPN and is using Google Drive to stage payloads also made it difficult for Palo Alto researchers to pin down the adversary’s geolocation, the report added.<\/p>\n

Bypassing Amazon’s Quarantining Protection?<\/h2>\n

When Palo Alto researchers deliberately exposed AWS keys on a public GitHub repository as part of the honeypot exercise, they found AWS quickly spotting the exposed keys and applying a quarantine policy that prevented the keys from being misused. In fact, by the time the attacker spotted the Palo Alto’s deliberately exposed keys on GitHub, AWS had already quarantined them.<\/p>\n

The fact that the threat actor is still able to use exposed keys to create EC2 accounts for cryptomining suggests that they are able to find exposed keys that AWS isn’t able to. “According to our evidence, they likely did,” Palo Alto said in its report. “In that case, the threat actor could proceed with the attack with no policy interfering with their malicious actions to steal resources from the victims.”<\/p>\n

The campaign highlights a disappointing failure by organizations to apply fundamental security practices, said Jeff Williams, co-founder and CTO of Contrast Security. “It’s not complicated, you just don’t post your keys in public,” Williams said in an emailed comment. “However, it’s also not fair to blame developers. There are thousands of these kinds of issues, and they have to perform perfectly on all of them or get dragged for being dumb or lazy,” he said. What really can help are authentication systems that make it easier for developers to make good choices, he added.<\/p>\n

Palo Alto itself recommended that organizations that might have inadvertently exposed AWS IAM credentials immediately revoke API connections tied to the credentials. They should also remove the credential and generate new AWS credentials. “We highly recommended that organizations use short-lived credentials to perform any dynamic functionality within a production environment,” the security vendor advised.<\/p>\n

Read More HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Cyber adversaries are scanning public GitHub repositories in real-time, evading Amazon quarantine controls, and harvesting AWS keys.Read More HERE<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[151],"tags":[],"class_list":["post-54379","post","type-post","status-publish","format-standard","hentry","category-darkreading-ti"],"yoast_head":"\n'Elektra-Leak' Attackers Harvest AWS Cloud Keys in GitHub Campaign 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"'Elektra-Leak' Attackers Harvest AWS Cloud Keys in GitHub Campaign 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2023-10-31T14:50:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltc775b6395373ab5c\/65400f9bc9a677040ac88c59\/crypto_Funtap_shutterstock.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"‘Elektra-Leak’ Attackers Harvest AWS Cloud Keys in GitHub Campaign\",\"datePublished\":\"2023-10-31T14:50:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\\\/\"},\"wordCount\":741,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltc775b6395373ab5c\\\/65400f9bc9a677040ac88c59\\\/crypto_Funtap_shutterstock.jpg\",\"articleSection\":[\"DarkReading |TI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\\\/\",\"name\":\"'Elektra-Leak' Attackers Harvest AWS Cloud Keys in GitHub Campaign 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltc775b6395373ab5c\\\/65400f9bc9a677040ac88c59\\\/crypto_Funtap_shutterstock.jpg\",\"datePublished\":\"2023-10-31T14:50:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\\\/#primaryimage\",\"url\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltc775b6395373ab5c\\\/65400f9bc9a677040ac88c59\\\/crypto_Funtap_shutterstock.jpg\",\"contentUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltc775b6395373ab5c\\\/65400f9bc9a677040ac88c59\\\/crypto_Funtap_shutterstock.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"‘Elektra-Leak’ Attackers Harvest AWS Cloud Keys in GitHub Campaign\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"'Elektra-Leak' Attackers Harvest AWS Cloud Keys in GitHub Campaign 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/","og_locale":"en_US","og_type":"article","og_title":"'Elektra-Leak' Attackers Harvest AWS Cloud Keys in GitHub Campaign 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2023-10-31T14:50:00+00:00","og_image":[{"url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltc775b6395373ab5c\/65400f9bc9a677040ac88c59\/crypto_Funtap_shutterstock.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"‘Elektra-Leak’ Attackers Harvest AWS Cloud Keys in GitHub Campaign","datePublished":"2023-10-31T14:50:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/"},"wordCount":741,"commentCount":0,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltc775b6395373ab5c\/65400f9bc9a677040ac88c59\/crypto_Funtap_shutterstock.jpg","articleSection":["DarkReading |TI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/","url":"https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/","name":"'Elektra-Leak' Attackers Harvest AWS Cloud Keys in GitHub Campaign 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltc775b6395373ab5c\/65400f9bc9a677040ac88c59\/crypto_Funtap_shutterstock.jpg","datePublished":"2023-10-31T14:50:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/#primaryimage","url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltc775b6395373ab5c\/65400f9bc9a677040ac88c59\/crypto_Funtap_shutterstock.jpg","contentUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltc775b6395373ab5c\/65400f9bc9a677040ac88c59\/crypto_Funtap_shutterstock.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/elektra-leak-attackers-harvest-aws-cloud-keys-in-github-campaign\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"‘Elektra-Leak’ Attackers Harvest AWS Cloud Keys in GitHub Campaign"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/54379","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=54379"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/54379\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=54379"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=54379"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=54379"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}