Threat Intelligence · Threat Hunting · Automation
Arthur Geo Thomas
Senior Threat Intelligence Analyst based in Dubai. I track threat actors, build hunting content and automate security operations, and share what I learn through write-ups and the RedKuppi Series.
Featured projects
All projects →Dark Web CTI Research Agent
An AI agent for tracking threat actors and APT activity across dark web sources.
MIRAI AI
Multi-tenant cyber threat intelligence SaaS platform, targeting the UAE and India markets.
SOAR Platform Migration
Migrated a security operations center from D3 to FortiSOAR — deployment, configuration and playbook rebuild.
Latest intelligence
Intel →Intel Drop 33 | SSHole: an OpenSSH login bypass exploited within hours
An OpenSSH login bypass (CVE-2026-123158, CVSS 8.1) affecting musl libc builds with PAM disabled, such as Alpine, was exploited on a honeypot about eight hours after disclosure.
Intel Drop 28 | SlippyNunchucks (ESET): Sogou Input Method hijack delivers DarkVigil
Sogou keyboard traffic hijacked to plant the DarkVigil backdoor, reported by ESET.
Intel Drop 29 | APT29-linked "Poisoned Source" watering holes (Sekoia)
Poisoned websites pushing exploit chains to phones, linked to APT29 and reported by Sekoia.
Latest hunts
Hunting →Hunt Drop 10 | Edge-to-Domain: Hunting the k0t Post-VPN Playbook
A VPN edge foothold has been turned into domain access.
Hunt Drop 09 | LLMJacking: find the hijacked AI before the bill does
A stolen cloud identity is reselling our AI quota.
Hunt Drop 08 | Trojanised Claude Code extension
The behaviours described in the Intel Drop on this topic (Trojanised Claude Code extension) are present in our telemetry.