# Threadlinqs

> Threadlinqs publishes Threadlinqs Intelligence, a live cyber-threat-intelligence platform: 2782+ profiled threats, 25477+ detections (Splunk SPL, Microsoft KQL, Sigma), 69273+ IOCs, 4206+ enriched CVEs, MITRE ATT&CK coverage and daily debriefs. This host (threadlinqs.com) carries the company, product, comparison, reference and blog pages; the corpus itself is served from intel.threadlinqs.com.

Usage: free to read, quote and cite, with attribution to Threadlinqs Intelligence and a link back to the page the material came from. Bulk redistribution of the corpus as a dataset is not permitted.
Freshness: this file was generated 2026-10-12T12:00:49.515Z. The corpus counts above were computed 2026-10-12T12:00:49.356Z and are refreshed on ingest (at most 25h old).

## About Threadlinqs
- Company and team: https://threadlinqs.com/about
- Editorial standards and sourcing policy: https://threadlinqs.com/editorial
- Security and responsible disclosure: https://threadlinqs.com/security
- Contact: https://threadlinqs.com/contact

## Platform
- Overview: https://threadlinqs.com/platform/
- Threat intelligence: https://threadlinqs.com/platform/threat-intelligence/
- Detection engineering: https://threadlinqs.com/platform/detection-engineering/
- Actor attribution: https://threadlinqs.com/platform/actor-attribution/
- Attack simulations: https://threadlinqs.com/platform/attack-simulations/
- MITRE ATT&CK coverage: https://threadlinqs.com/platform/mitre-coverage/
- MCP integration: https://threadlinqs.com/platform/mcp-integration/

## Solutions
- Overview: https://threadlinqs.com/solutions/
- SOC teams: https://threadlinqs.com/solutions/soc-teams/
- Detection engineers: https://threadlinqs.com/solutions/detection-engineers/
- Threat hunters: https://threadlinqs.com/solutions/threat-hunters/

## Comparisons
- Overview: https://threadlinqs.com/compare/
- vs Recorded Future: https://threadlinqs.com/compare/vs-recorded-future/
- vs Anomali: https://threadlinqs.com/compare/vs-anomali/
- vs Intel 471: https://threadlinqs.com/compare/vs-intel-471/
- vs SOCRadar: https://threadlinqs.com/compare/vs-socradar/

## Reference
- Resources hub: https://threadlinqs.com/resources/
- Glossary: https://threadlinqs.com/resources/glossary/
- What is threat intelligence: https://threadlinqs.com/resources/glossary/what-is-threat-intelligence/
- What is detection engineering: https://threadlinqs.com/resources/glossary/what-is-detection-engineering/
- What is MITRE ATT&CK: https://threadlinqs.com/resources/glossary/what-is-mitre-attack/
- What are Sigma rules: https://threadlinqs.com/resources/glossary/what-is-sigma-rules/
- What is SPL: https://threadlinqs.com/resources/glossary/what-is-spl/
- CVE Lens: https://threadlinqs.com/cve-lens

## Blog
In-depth threat reports with SPL/KQL/Sigma detections: https://threadlinqs.com/blog/

## Threat intelligence corpus (intel.threadlinqs.com, public and crawlable)
- Threat pages: https://intel.threadlinqs.com/threat/TL-YYYY-NNNN (append `.md` for clean Markdown)
- CVE pages: https://intel.threadlinqs.com/cve/CVE-YYYY-NNNN (append `.md` for Markdown)
- Threat-actor pages: https://intel.threadlinqs.com/actor/<name> (append `.md` for Markdown)
- Daily debrief: https://intel.threadlinqs.com/debrief (Markdown twin: https://intel.threadlinqs.com/debrief.md)
- Live CVE feed: https://intel.threadlinqs.com/vulnerabilities
- Platform statistics: https://intel.threadlinqs.com/statistics
- ATT&CK coverage: https://intel.threadlinqs.com/coverage
- Sitemap index: https://intel.threadlinqs.com/sitemap-index.xml
- RSS (latest threats): https://intel.threadlinqs.com/feed.xml · JSON Feed: https://intel.threadlinqs.com/feed.json
- Filtered feeds (swap `.xml` for `.json` for JSON Feed): https://intel.threadlinqs.com/feed/severity/<critical|high|medium|low>.xml · https://intel.threadlinqs.com/feed/category/<slug>.xml · https://intel.threadlinqs.com/feed/actor/<name>.xml (<name> as in the actor page URL)

### Browse the corpus (hub pages)
- Threat actors: https://intel.threadlinqs.com/actors
- CVEs: https://intel.threadlinqs.com/cves
- ATT&CK techniques: https://intel.threadlinqs.com/techniques
- Vendors: https://intel.threadlinqs.com/vendors
- Weaknesses (CWE): https://intel.threadlinqs.com/cwes
- Daily debrief archive: https://intel.threadlinqs.com/debrief/archive

### Example entities (live, fetchable now)
- Threat: https://intel.threadlinqs.com/threat/TL-2026-0002 (Markdown twin: /threat/TL-2026-0002.md)
- Threat: https://intel.threadlinqs.com/threat/TL-2026-0004
- CVE: https://intel.threadlinqs.com/cve/CVE-2024-3400 (Markdown twin: /cve/CVE-2024-3400.md)
- CVE: https://intel.threadlinqs.com/cve/CVE-2021-44228
- Threat actor: https://intel.threadlinqs.com/actor/Lazarus%20Group (Markdown twin: /actor/Lazarus%20Group.md)
- ATT&CK technique: https://intel.threadlinqs.com/technique/T1566 (Markdown twin: /technique/T1566.md)
- Weakness: https://intel.threadlinqs.com/cwe/CWE-79 (Markdown twin: /cwe/CWE-79.md)
- Vendor: https://intel.threadlinqs.com/vendors/ivanti (Markdown twin: /vendors/ivanti.md)
- Daily debrief: https://intel.threadlinqs.com/debrief/YYYY-MM-DD, any recent date listed on the archive (Markdown twin: /debrief/YYYY-MM-DD.md)
Every entity page above (threat, CVE, actor, ATT&CK technique, CWE weakness, vendor, daily debrief) has a Markdown twin: append `.md` to its URL for the same facts as clean Markdown.

## Corpus composition
Profiled threats by severity: CRITICAL 826 · HIGH 1,601 · MEDIUM 314 · LOW 13 · INFO 15.

Profiled threats by category:
- VULNERABILITY: 853
- MALWARE: 706
- SUPPLY_CHAIN: 274
- PHISHING: 212
- RANSOMWARE: 186
- THREAT_INTEL: 173
- APT: 167
- DATA_BREACH: 80
- ZERO_DAY: 31
- ICS_SCADA: 17
- CLOUD: 15
- CAMPAIGN: 14
- THREAT_ACTOR: 12
- FRAUD: 6
- ADVISORY: 3
- AI_SECURITY: 3
- INTRUSION: 3
- CYBERCRIME: 2
- ESPIONAGE: 2
- MISCONFIGURATION: 2

## MITRE ATT&CK coverage by tactic
Tactic labels are normalised across the Enterprise, ICS, Mobile and ATLAS matrices. Full map: https://intel.threadlinqs.com/coverage
- Stealth (formerly Defense Evasion): 156 distinct techniques across 2,333 profiled threats
- Persistence: 96 distinct techniques across 1,906 profiled threats
- Credential Access: 64 distinct techniques across 2,012 profiled threats
- Execution: 60 distinct techniques across 2,362 profiled threats
- Collection: 59 distinct techniques across 2,000 profiled threats
- Discovery: 57 distinct techniques across 1,988 profiled threats
- Privilege Escalation: 54 distinct techniques across 1,057 profiled threats
- Resource Development: 53 distinct techniques across 1,793 profiled threats
- Impact: 52 distinct techniques across 1,576 profiled threats
- Command and Control: 44 distinct techniques across 2,003 profiled threats
- Reconnaissance: 43 distinct techniques across 1,051 profiled threats
- Defense Impairment: 41 distinct techniques across 1,134 profiled threats
- Initial Access: 37 distinct techniques across 2,465 profiled threats
- Defense Evasion (Mobile): 32 distinct techniques across 66 profiled threats
- Exfiltration: 26 distinct techniques across 1,455 profiled threats
- Lateral Movement: 24 distinct techniques across 1,053 profiled threats

## Most-profiled threat actors
- TeamPCP — 53 profiled threats: https://intel.threadlinqs.com/actor/TeamPCP
- Bluenoroff — 49 profiled threats: https://intel.threadlinqs.com/actor/Bluenoroff
- APT38 — 48 profiled threats: https://intel.threadlinqs.com/actor/APT38
- Altered Spider — 47 profiled threats: https://intel.threadlinqs.com/actor/Altered%20Spider
- COPERNICIUM — 46 profiled threats: https://intel.threadlinqs.com/actor/COPERNICIUM
- BeagleBoyz — 43 profiled threats: https://intel.threadlinqs.com/actor/BeagleBoyz
- Sapphire Sleet — 37 profiled threats: https://intel.threadlinqs.com/actor/Sapphire%20Sleet
- Stardust Chollima — 36 profiled threats: https://intel.threadlinqs.com/actor/Stardust%20Chollima
- G0082 — 35 profiled threats: https://intel.threadlinqs.com/actor/G0082
- ShinyHunters — 32 profiled threats: https://intel.threadlinqs.com/actor/ShinyHunters
- NICKEL GLADSTONE — 31 profiled threats: https://intel.threadlinqs.com/actor/NICKEL%20GLADSTONE
- Lazarus Group — 29 profiled threats: https://intel.threadlinqs.com/actor/Lazarus%20Group
- PurpleBravo — 28 profiled threats: https://intel.threadlinqs.com/actor/PurpleBravo
- APT28 — 26 profiled threats: https://intel.threadlinqs.com/actor/APT28
- Diamond Sleet — 26 profiled threats: https://intel.threadlinqs.com/actor/Diamond%20Sleet
- Andariel — 25 profiled threats: https://intel.threadlinqs.com/actor/Andariel
- Black Artemis — 24 profiled threats: https://intel.threadlinqs.com/actor/Black%20Artemis
- HIDDEN COBRA — 24 profiled threats: https://intel.threadlinqs.com/actor/HIDDEN%20COBRA
- Appleworm — 23 profiled threats: https://intel.threadlinqs.com/actor/Appleworm
- APT 38 — 23 profiled threats: https://intel.threadlinqs.com/actor/APT%2038
- APT-C-26 — 23 profiled threats: https://intel.threadlinqs.com/actor/APT-C-26
- ATK117 — 23 profiled threats: https://intel.threadlinqs.com/actor/ATK117
- ATK3 — 23 profiled threats: https://intel.threadlinqs.com/actor/ATK3
- Bureau 121 — 23 profiled threats: https://intel.threadlinqs.com/actor/Bureau%20121
- Citrine Sleet — 23 profiled threats: https://intel.threadlinqs.com/actor/Citrine%20Sleet

## Actively exploited CVEs (CISA KEV, highest EPSS first)
- CVE-2024-3400 (CVSS 10, EPSS >99.9%, ransomware-linked): https://intel.threadlinqs.com/cve/CVE-2024-3400
- CVE-2021-44228 (CVSS 10, EPSS >99.9%, ransomware-linked): https://intel.threadlinqs.com/cve/CVE-2021-44228
- CVE-2019-11510 (CVSS 9.9, EPSS >99.9%, ransomware-linked): https://intel.threadlinqs.com/cve/CVE-2019-11510
- CVE-2020-5902 (CVSS 9.8, EPSS >99.9%, ransomware-linked): https://intel.threadlinqs.com/cve/CVE-2020-5902
- CVE-2014-6271 (CVSS 9.8, EPSS >99.9%): https://intel.threadlinqs.com/cve/CVE-2014-6271
- CVE-2019-0708 (CVSS 9.8, EPSS >99.9%, ransomware-linked): https://intel.threadlinqs.com/cve/CVE-2019-0708
- CVE-2017-5638 (CVSS 9.8, EPSS >99.9%, ransomware-linked): https://intel.threadlinqs.com/cve/CVE-2017-5638
- CVE-2022-29464 (CVSS 9.8, EPSS >99.9%, ransomware-linked): https://intel.threadlinqs.com/cve/CVE-2022-29464
- CVE-2022-26134 (CVSS 9.8, EPSS >99.9%, ransomware-linked): https://intel.threadlinqs.com/cve/CVE-2022-26134
- CVE-2021-35464 (CVSS 9.8, EPSS >99.9%, ransomware-linked): https://intel.threadlinqs.com/cve/CVE-2021-35464
- CVE-2023-27350 (CVSS 9.8, EPSS >99.9%, ransomware-linked): https://intel.threadlinqs.com/cve/CVE-2023-27350
- CVE-2024-23897 (CVSS 9.8, EPSS >99.9%, ransomware-linked): https://intel.threadlinqs.com/cve/CVE-2024-23897
- CVE-2019-19781 (CVSS 9.8, EPSS >99.9%, ransomware-linked): https://intel.threadlinqs.com/cve/CVE-2019-19781
- CVE-2023-35078 (CVSS 9.8, EPSS >99.9%, ransomware-linked): https://intel.threadlinqs.com/cve/CVE-2023-35078
- CVE-2023-4966 (CVSS 9.4, EPSS >99.9%, ransomware-linked): https://intel.threadlinqs.com/cve/CVE-2023-4966
- CVE-2024-21887 (CVSS 9.1, EPSS >99.9%, ransomware-linked): https://intel.threadlinqs.com/cve/CVE-2024-21887
- CVE-2021-34473 (CVSS 9.1, EPSS >99.9%, ransomware-linked): https://intel.threadlinqs.com/cve/CVE-2021-34473
- CVE-2018-13379 (CVSS 9.1, EPSS >99.9%, ransomware-linked): https://intel.threadlinqs.com/cve/CVE-2018-13379
- CVE-2023-1389 (CVSS 8.8, EPSS >99.9%): https://intel.threadlinqs.com/cve/CVE-2023-1389
- CVE-2023-32315 (CVSS 8.6, EPSS >99.9%): https://intel.threadlinqs.com/cve/CVE-2023-32315

## Latest threats
- TL-2026-3349 [MEDIUM · THREAT_INTEL · 2026-10-12] AI-Accelerated Hands-On WordPress Plugin Vulnerability Research: 16 Runtime-Reproducible Flaws (Sucuri, Part 1) — https://intel.threadlinqs.com/threat/TL-2026-3349 (Markdown: append .md)
- TL-2026-3343 [HIGH · MALWARE · TA4922 · 2026-10-12] WhatsApp-Delivered VulcanRAT207.A Injects into Windows Task Scheduler (PoolParty Variant 7) to Run as SYSTEM — https://intel.threadlinqs.com/threat/TL-2026-3343 (Markdown: append .md)
- TL-2026-3342 [MEDIUM · MALWARE · WardenStealer · 2026-10-12] WARDENStealer (win.warden_stealer) - Windows x64 MaaS Stealer, Clipper and Loader; MalwareBazaar sample 2dda0c1d...805926e — https://intel.threadlinqs.com/threat/TL-2026-3342 (Markdown: append .md)
- TL-2026-3341 [CRITICAL · VULNERABILITY · 2026-10-12] Active Exploitation of Bricksforge WordPress Plugin Unauthenticated File Upload / RCE (CVE-2026-85097, CVSS 9.8–10.0) — https://intel.threadlinqs.com/threat/TL-2026-3341 (Markdown: append .md)
- TL-2026-3335 [HIGH · RANSOMWARE · Kimsuky · 2026-10-12] Kimsuky-Linked Funhouse Ransomware (Endpoint Ransomware Variant) Distributed via Malicious Hangul Resume Documents and Quasar RAT — https://intel.threadlinqs.com/threat/TL-2026-3335 (Markdown: append .md)
- TL-2026-3332 [CRITICAL · VULNERABILITY · 2026-10-12] CISA KEV: Apache Struts Dynamic Method Invocation Remote Code Execution (CVE-2016-3081 / S2-032) Exploited in Attacks — https://intel.threadlinqs.com/threat/TL-2026-3332 (Markdown: append .md)
- TL-2026-3329 [HIGH · VULNERABILITY · 2026-10-12] Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for Arbitrary File Read (CVE-2026-55420) — https://intel.threadlinqs.com/threat/TL-2026-3329 (Markdown: append .md)
- TL-2026-3328 [HIGH · MALWARE · 2026-10-12] Casbaneiro Banking Trojan Activates Only When Victims Visit Targeted Bank Websites — https://intel.threadlinqs.com/threat/TL-2026-3328 (Markdown: append .md)
- TL-2026-3321 [CRITICAL · VULNERABILITY · 2026-10-12] Citrix NetScaler ADC/Gateway Pre-Auth RCE via SAML Heap Overflow (CVE-2026-8452) Exploited in the Wild — https://intel.threadlinqs.com/threat/TL-2026-3321 (Markdown: append .md)
- TL-2026-3319 [HIGH · APT · Volt Typhoon - G1017 · 2026-10-11] Centrii: Nation-State Pre-Positioning (Volt Typhoon, IRGC-Affiliated PLC Exploitation) and Renewable Supply-Chain Risk Raise Energy Sector Exposure — https://intel.threadlinqs.com/threat/TL-2026-3319 (Markdown: append .md)
- TL-2026-3317 [MEDIUM · THREAT_INTEL · 2026-10-11] Rising Cyber Threats Targeting Maritime Ports, Vessels and Logistics Supply Chains — https://intel.threadlinqs.com/threat/TL-2026-3317 (Markdown: append .md)
- TL-2026-3315 [CRITICAL · VULNERABILITY · 2026-10-11] CVE-2026-13043: WatchGuard/Panda Kernel Memory Access Driver (pskmad.sys) Missing Authentication Exposes Kernel and Process Memory — https://intel.threadlinqs.com/threat/TL-2026-3315 (Markdown: append .md)
- TL-2026-3314 [CRITICAL · VULNERABILITY · 2026-10-11] IBM Langflow OSS Multiple Vulnerabilities Including Two Critical Unauthenticated RCE Flaws (CVE-2026-104334, CVE-2026-93674) — https://intel.threadlinqs.com/threat/TL-2026-3314 (Markdown: append .md)
- TL-2026-3312 [MEDIUM · DATA_BREACH · 2026-10-11] Nippon Columbia Group contractor malware incident exposes ~8.72M Daiichi Kosho (BIG ECHO / Karaoke CLUB DAM) customer and employee records — https://intel.threadlinqs.com/threat/TL-2026-3312 (Markdown: append .md)
- TL-2026-3306 [MEDIUM · DATA_BREACH · 2026-10-11] Danish PII Exposures (DTU DTUBasen Breach and CPR Register Misuse) Increase Risk of Targeted Phishing — https://intel.threadlinqs.com/threat/TL-2026-3306 (Markdown: append .md)
- TL-2026-3305 [MEDIUM · THREAT_INTEL · 2026-10-11] Non-Human Identity (NHI) Attacks: Over-Privileged, Long-Lived Credentials on Service Accounts, Scripts, IoT and Third-Party Integrations — https://intel.threadlinqs.com/threat/TL-2026-3305 (Markdown: append .md)
- TL-2026-3302 [HIGH · RANSOMWARE · Anubis · 2026-10-11] Anubis Ransomware Attack on Fairlife via CitrixBleed 2 (CVE-2025-5777) - Network Edge Risk — https://intel.threadlinqs.com/threat/TL-2026-3302 (Markdown: append .md)
- TL-2026-3297 [MEDIUM · DATA_BREACH · BYOD · 2026-10-10] BYOD Ransomware Group Claims Trump Mobile Customer Data Breach via Liberty Mobile Employee Malware Infection — https://intel.threadlinqs.com/threat/TL-2026-3297 (Markdown: append .md)
- TL-2026-3291 [MEDIUM · THREAT_INTEL · OpenAI autonomous agents · 2026-10-10] Wikimedia Foundation reports OpenAI autonomous agents attempted unapproved Wikipedia edits, citation-tool proxy misuse and Etherpad compromise — https://intel.threadlinqs.com/threat/TL-2026-3291 (Markdown: append .md)
- TL-2026-3283 [HIGH · MALWARE · 2026-10-10] CrocoRat ClickFix Campaign Using DNS TXT Payload Delivery and Domain-Aware RAT/Stealer Deployment — https://intel.threadlinqs.com/threat/TL-2026-3283 (Markdown: append .md)
- TL-2026-3276 [CRITICAL · VULNERABILITY · 2026-10-10] Multiple Vulnerabilities in Google Chrome (CVE-2026-103621 through CVE-2026-103631) - GovCERT.HK A26-10-08 — https://intel.threadlinqs.com/threat/TL-2026-3276 (Markdown: append .md)
- TL-2026-3274 [HIGH · VULNERABILITY · 2026-10-10] F5 F5OS 2.0.0 Affected by Linux Kernel UDF Partition Descriptor Heap Out-of-Bounds Write (CVE-2026-45991) — https://intel.threadlinqs.com/threat/TL-2026-3274 (Markdown: append .md)
- TL-2026-3271 [MEDIUM · RANSOMWARE · Vexy Ransomware · 2026-10-10] Vexy Ransomware claims KOOKABARRA JUICE (37 GB exfiltrated) — https://intel.threadlinqs.com/threat/TL-2026-3271 (Markdown: append .md)
- TL-2026-3268 [HIGH · VULNERABILITY · 2026-10-10] Elastic Patches 14 Security Flaws Including Kibana Cross-Tenant Data Interception (CVE-2026-102406) — https://intel.threadlinqs.com/threat/TL-2026-3268 (Markdown: append .md)
- TL-2026-3266 [HIGH · DATA_BREACH · 2026-10-10] Danish CPR Central Register of Persons Breach via Abuse of a Private Company's Legitimate Access (Supply Chain) — https://intel.threadlinqs.com/threat/TL-2026-3266 (Markdown: append .md)
- TL-2026-3259 [MEDIUM · VULNERABILITY · 2026-10-10] WordPress 7.1.3 Security Release: Seven Fixes Including Stored XSS, Second-Order SQL Injection and Unauthenticated Comment Disclosure — https://intel.threadlinqs.com/threat/TL-2026-3259 (Markdown: append .md)
- TL-2026-3252 [HIGH · VULNERABILITY · 2026-10-10] Android October 2026 Security Bulletin - 25 Vulnerabilities Patched in Framework and System (Patch Level 2026-10-01) — https://intel.threadlinqs.com/threat/TL-2026-3252 (Markdown: append .md)
- TL-2026-3251 [CRITICAL · VULNERABILITY · 2026-10-10] Chrome 155 Update Patches 247 Vulnerabilities Including 4 Critical Use-After-Free Flaws (CVE-2026-106382, CVE-2026-106197, CVE-2026-106358, CVE-2026-106347) — https://intel.threadlinqs.com/threat/TL-2026-3251 (Markdown: append .md)
- TL-2026-3247 [HIGH · DATA_BREACH · ShinyHunters · 2026-10-10] Rockstar Games Breaches: Lapsus$ Source Code Theft, ShinyHunters Anodot/Snowflake OAuth Data Theft (78.6M Records), and Cyberleek Fake GTA VI Build Malware — https://intel.threadlinqs.com/threat/TL-2026-3247 (Markdown: append .md)
- TL-2026-3244 [MEDIUM · THREAT_INTEL · 2026-10-10] Anthropic Disables Live Internet Access for Internal AI Evaluations After Claude Models Exploit Injection Flaws and Submit Unauthorized Forms — https://intel.threadlinqs.com/threat/TL-2026-3244 (Markdown: append .md)
- TL-2026-3234 [MEDIUM · PHISHING · 2026-10-10] DeKalb County, Indiana Vendor Impersonation Email Payment Fraud (Oct 2026) — https://intel.threadlinqs.com/threat/TL-2026-3234 (Markdown: append .md)
- TL-2026-3231 [MEDIUM · DATA_BREACH · 2026-10-10] Advantest Discloses Data Breach Months After February 2026 Ransomware Attack — https://intel.threadlinqs.com/threat/TL-2026-3231 (Markdown: append .md)
- TL-2026-3226 [CRITICAL · VULNERABILITY · 2026-10-10] Progress DataDirect GenAI Command Injection via OpenAPI/Swagger Filename (CVE-2026-91140) — https://intel.threadlinqs.com/threat/TL-2026-3226 (Markdown: append .md)
- TL-2026-3223 [HIGH · APT · DarkBlinders · 2026-10-10] DarkBlinders Uses Fake StarkMeet Meeting App and GitHub C2 to Deploy RuntimeBroker Backdoor Against Government Targets — https://intel.threadlinqs.com/threat/TL-2026-3223 (Markdown: append .md)
- TL-2026-3220 [HIGH · THREAT_INTEL · 2026-10-10] AI Agent-Driven Intrusion Chains Exposed Tomcat Spring Batch Endpoint to GodPotato/PrintSpoofer SYSTEM Escalation on Windows — https://intel.threadlinqs.com/threat/TL-2026-3220 (Markdown: append .md)
- TL-2026-3218 [MEDIUM · PHISHING · 2026-10-10] Attackers Hide AI Prompt Injections Inside Phishing Emails to Manipulate AI Email Assistants — https://intel.threadlinqs.com/threat/TL-2026-3218 (Markdown: append .md)
- TL-2026-3217 [MEDIUM · THREAT_INTEL · 2026-10-10] Deepfake scam operating inside a larger multi-stage fraud campaign (Bolster AI analysis) — https://intel.threadlinqs.com/threat/TL-2026-3217 (Markdown: append .md)
- TL-2026-3216 [HIGH · SUPPLY_CHAIN · 2026-10-10] Sonatype Q3 2026 Open Source Malware Index: Compounding Supply-Chain Compromise (Mini Shai-Hulud npm wave, mlflow-ui PyPI AI-agent-uploaded malware) — https://intel.threadlinqs.com/threat/TL-2026-3216 (Markdown: append .md)
- TL-2026-3214 [HIGH · SUPPLY_CHAIN · PolinRider · 2026-10-10] ChainDrop npm Worm and PolinRider DPRK-Linked Operation Use Blockchain C2 to Steal Cloud and CI/CD Credentials — https://intel.threadlinqs.com/threat/TL-2026-3214 (Markdown: append .md)
- TL-2026-3209 [CRITICAL · VULNERABILITY · 2026-10-10] Critical Cisco Nexus 3000/9000 NX-OS NGOAM Stack Buffer Overflows Allow Unauthenticated Root Code Execution (CVE-2026-76485, CVE-2026-76486, CVE-2026-76501) — https://intel.threadlinqs.com/threat/TL-2026-3209 (Markdown: append .md)

## Free machine-readable feeds
- STIX 2.1 + TAXII 2.1 + native MISP feeds: see https://intel.threadlinqs.com/mcp for endpoints
- Free C2 blocklist: generated from live C2 tracking (see MCP docs)

## MCP — AI-agent access (v8.2.0, Purple tier)
- Official MCP registry: com.threadlinqs/intelthreadlinqs-mcp
- Source (MIT): https://github.com/threadlinqs-cmd/intelthreadlinqs-mcp
- npm: intelthreadlinqs-mcp — `npx -y intelthreadlinqs-mcp` (stdio, THREADLINQS_API_KEY)
- Remote: POST https://intel.threadlinqs.com/mcp (Streamable-HTTP, OAuth 2.1)
- Manifest: https://intel.threadlinqs.com/.well-known/mcp.json
- Docs: https://intel.threadlinqs.com/mcp (Markdown twin: /mcp.md)
- Agent skill: https://intel.threadlinqs.com/mcp/skill.md (single file) · https://intel.threadlinqs.com/skills/intelthreadlinqs-mcp-skill.zip
- Machine catalog (no key required): https://intel.threadlinqs.com/mcp/catalog.json
81 tools and 25 analyst-playbook prompts: search_threats, get_threat, hunt (TLQL over a 106k-row observation index), search_detections, search_iocs, get_cve_intelligence, get_actor, get_attribution_evidence, explain_correlation, get_mitre_coverage, get_c2, get_correlations, get_osint_trends, list_debriefs, export_stix and more. Purple or Gold subscription required (tier >= 3).

## Pricing, access and contact
- Pricing and tiers (Blue free, Red, Purple $11.99/mo, Gold enterprise): https://threadlinqs.com/pricing (Markdown twin: https://intel.threadlinqs.com/pricing.md)
- Access ladder: The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server.
- Contact: contact@threadlinqs.com
- Enterprise / Gold enquiries: https://threadlinqs.com/contact

## Legal
- Privacy: https://threadlinqs.com/privacy
- Terms: https://threadlinqs.com/terms
- Cookies: https://threadlinqs.com/cookies
- Do not sell my personal information: https://threadlinqs.com/do-not-sell

## Sitemaps
- Marketing site: https://threadlinqs.com/sitemaps/marketing.xml
- Blog: https://threadlinqs.com/sitemaps/blog.xml
- Intelligence corpus (index): https://intel.threadlinqs.com/sitemap-index.xml

## Companion file
- Index only (shorter): https://threadlinqs.com/llms.txt
- The other host's index: https://intel.threadlinqs.com/llms.txt