{"id":55157,"date":"2024-01-25T15:04:15","date_gmt":"2024-01-25T15:04:15","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/35445\/GitHub-NPM-Registry-Abused-To-Host-SSH-Key-Stealing-Malware.html"},"modified":"2024-01-25T15:04:15","modified_gmt":"2024-01-25T15:04:15","slug":"github-npm-registry-abused-to-host-ssh-key-stealing-malware","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\/","title":{"rendered":"GitHub, NPM Registry Abused To Host SSH Key-Stealing Malware"},"content":{"rendered":"
<\/div>\n

Malicious NPM packages designed to upload stolen SSH keys to GitHub were discovered by software threat researchers this month.<\/p>\n

GitHub removed two packages from the NPM registry in early January  \u2014 warbeast2000 and kodiak2k  \u2014 both of which were designed to grab private SSH keys from machines they are installed on and store the keys on an attacker-controlled GitHub repository.<\/p>\n

The SSH key-stealing malware tools were first discovered by researchers at ReversingLabs using the company\u2019s Software Supply Chain Security platform. The malicious packages were found during the first week of January 2024 and removed by the GitHub-owned NPM registry shortly after they were reported.<\/p>\n

The details of warbeast2000 and kodiak2k were first disclosed by ReversingLabs in a blog post<\/a> on Jan. 23.<\/p>\n

\u201cSince there are instructions in the code\u2019s comments, the [package] author\u2019s intention is possibly to share malicious code with other malicious actors,\u201d Lucija Valenti\u0107, a software threat researcher at ReversingLabs and author of the blog post, told SC Media. \u201cThey may also be hoping for developers and users to download and install warbeast2000 and kodiak2k.\u201d<\/p>\n

Software developers at risk from dangerous NPM packages<\/h2>\n

The warbeast2000 and kodiak2k packages both use a postinstall script to retrieve additional JavaScript code from an external source and execute it on a victim\u2019s machine. At least one of the packages (warbeast2000) retrieves this second malicious script from a Pastebin address.<\/p>\n

The payload installed and executed by warbeast2000 targets the id_rsa file located at \/.ssh within the victim\u2019s home directory to grab the private SSH key stored within this file. \u201cId_rsa\u201d is the default file name for SSH keys generated by ssh-keygen, which is standard on Unix, Linux and macOS systems as well as Git for Windows.<\/p>\n

After reading the private SSH key, warbeast2000\u2019s final payload copies the key, encodes it in Base64 and uploads it to a GitHub repository controlled by the attacker. Warbeast2000 has no other functions and does not appear to imitate other legitimate packages.<\/p>\n

Kodiak2k\u2019s payload works similarly to warbeast2000\u2019s, but instead of going after id_rsa, it searches (home directory)\/.ssh for a file named \u201cmeow,\u201d which the ReversingLabs researchers theorize is a just a placeholder name. As with warbeast2000, if the \u201cmeow\u201d key is found, it is uploaded in a Base64 format to an attacker-controlled GitHub repository by the malware.<\/p>\n

Additionally, later versions of kodiak2k executed a script from the archived GitHub repository of the Empire post-exploitation framework, which includes code related to the Mimikatz credential stealer. There were some non-malicious functions observed such as a function for running notepad.exe, and the researchers said kodiak2k was likely still undergoing development when it was removed from the NPM registry.<\/p>\n

Valenti\u0107 told SC Media that it can\u2019t be said for sure whether warbeast2000 and kodiak2k were created by the same threat actor.<\/p>\n

The potential breach of SSH keys by packages like warbeast2000 and kodiak2k is dangerous for software developers using the same open-source repositories where the malware was uploaded.<\/p>\n

\u201cSSH keys provide those who hold them the ability to access and contribute to GitHub repositories, including those containing proprietary (non-public) code,\u201d Valenti\u0107 wrote on the ReversingLabs blog. \u201cAs attacks like those on SolarWinds and 3CX show, that level of access can have a serious and negative impact on the security of the software producer, as well as the end user organizations that deploy and use the affected software: fueling devastating software supply chain attacks.\u201d<\/p>\n

Warbeast2000 had eight versions and was downloaded nearly 400 times by the time it was removed, while kodiak2k had more than 30 versions and was downloaded about 950 times before its removal, according to ReversingLabs.<\/p>\n

Open-source package managers face 1,300% increase in malware uploads<\/h2>\n

The NPM registry has been misused to distribute malware many times in the past, with recent examples including a campaign that targeted Roblox developers<\/a> with the Luna Grabber information stealer last August and a flood of 15,000 phishing packages<\/a> that hit the registry last February.<\/p>\n

GitHub and the NPM repository are not alone, as the Python Package Index (PyPI) has also been plagued with malicious packages<\/a>, some amassing thousands of downloads<\/a>.<\/p>\n

ReversingLab\u2019s State of Software Supply Chain Security 2024 report<\/a> revealed that 13 times more malware packages were found circulating in open source package repositories like NPM and PyPI in 2023 compared with 2020.<\/p>\n

Valenti\u0107 outlined some of the red flags developers should look for when considering using packages from open source websites.<\/p>\n

It “could be things like typosquatting (dressing a package up to look like another known\/pouplar open source package), the presence of obfuscated code (unusual in an open source package), or (as in this case) post-install scripts that fetch and execute files from outside of the package,\u201d Valenti\u0107 explained in an email to SC Media.<\/p>\n

The NPM registry and PyPI platforms themselves have also taken steps to respond to growing security threats, Valenti\u0107 noted.<\/p>\n

\u201cThat\u2019s particularly true around account security, with platforms like npm strongly encouraging developers to adopt multi-factor authentication, code scanning, and more granular permissions for access tokens,\u201d Valenti\u0107 said. \u201cPlatforms like GitHub, npm and others have also stepped up scanning for accidentally exposed secrets or PII.\u201d<\/p>\n

GitHub did not respond to questions from SC Media about warbeast2000 and kodiak2k or its safeguards against malware distribution.<\/p>\n

READ MORE HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

READ MORE HERE…<\/p>\n","protected":false},"author":2,"featured_media":55158,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[277],"tags":[10829],"class_list":["post-55157","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-blogs","tag-headlinehackermalwarefraudbackdoorcryptography"],"yoast_head":"\nGitHub, NPM Registry Abused To Host SSH Key-Stealing Malware 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GitHub, NPM Registry Abused To Host SSH Key-Stealing Malware 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2024-01-25T15:04:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/files.scmagazine.com\/wp-content\/uploads\/2024\/01\/GettyImages-1241291790-1.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"GitHub, NPM Registry Abused To Host SSH Key-Stealing Malware\",\"datePublished\":\"2024-01-25T15:04:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\\\/\"},\"wordCount\":895,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/01\\\/github-npm-registry-abused-to-host-ssh-key-stealing-malware.jpg\",\"keywords\":[\"headline,hacker,malware,fraud,backdoor,cryptography\"],\"articleSection\":[\"CyberSecurity Blogs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\\\/\",\"name\":\"GitHub, NPM Registry Abused To Host SSH Key-Stealing Malware 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/01\\\/github-npm-registry-abused-to-host-ssh-key-stealing-malware.jpg\",\"datePublished\":\"2024-01-25T15:04:15+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/01\\\/github-npm-registry-abused-to-host-ssh-key-stealing-malware.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/01\\\/github-npm-registry-abused-to-host-ssh-key-stealing-malware.jpg\",\"width\":800,\"height\":533},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"headline,hacker,malware,fraud,backdoor,cryptography\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/headlinehackermalwarefraudbackdoorcryptography\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"GitHub, NPM Registry Abused To Host SSH Key-Stealing Malware\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"GitHub, NPM Registry Abused To Host SSH Key-Stealing Malware 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\/","og_locale":"en_US","og_type":"article","og_title":"GitHub, NPM Registry Abused To Host SSH Key-Stealing Malware 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2024-01-25T15:04:15+00:00","og_image":[{"url":"https:\/\/files.scmagazine.com\/wp-content\/uploads\/2024\/01\/GettyImages-1241291790-1.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"GitHub, NPM Registry Abused To Host SSH Key-Stealing Malware","datePublished":"2024-01-25T15:04:15+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\/"},"wordCount":895,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/01\/github-npm-registry-abused-to-host-ssh-key-stealing-malware.jpg","keywords":["headline,hacker,malware,fraud,backdoor,cryptography"],"articleSection":["CyberSecurity Blogs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\/","url":"https:\/\/www.threatshub.org\/blog\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\/","name":"GitHub, NPM Registry Abused To Host SSH Key-Stealing Malware 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/01\/github-npm-registry-abused-to-host-ssh-key-stealing-malware.jpg","datePublished":"2024-01-25T15:04:15+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/01\/github-npm-registry-abused-to-host-ssh-key-stealing-malware.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/01\/github-npm-registry-abused-to-host-ssh-key-stealing-malware.jpg","width":800,"height":533},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/github-npm-registry-abused-to-host-ssh-key-stealing-malware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"headline,hacker,malware,fraud,backdoor,cryptography","item":"https:\/\/www.threatshub.org\/blog\/tag\/headlinehackermalwarefraudbackdoorcryptography\/"},{"@type":"ListItem","position":3,"name":"GitHub, NPM Registry Abused To Host SSH Key-Stealing Malware"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/55157","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=55157"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/55157\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/55158"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=55157"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=55157"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=55157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}