CyberCede Ops | Threat Intelligence

Elite threat intel & security ops briefings. Powered by CyberCede Corp. We decrypt the noise so you can operationalize your defense. Stay paranoid. Stay secure.

[OffSec @offsectraining]

#OSAI is officially here! 📣🐺

OffSec’s newest certification for hands-on offensive operations against AI-enabled systems is now available for purchase with Learn One, Course & Cert Bundle, and Learn Enterprise.

Built for practitioners who want to apply an adversary mindset to modern AI systems and stay ahead as the attack surface evolves.

🔗 https://t.co/SRN3DaGaNi

[Fusion Intelligence Center @ StealthMole @stealthmole_int]

Government-Related Leak and Exposure Activity Observed in the Fourth Week of March 2026

Government-related data exposure activity during the fourth week of March 2026 was distributed across ransomware leak sites, forum sales posts, and paste-sharing platforms. The observed set includes named government institutions, government domains, police-related entities, ministries, and public-sector personnel datasets.

Several recurrent publisher identities appeared across multiple listings. The most prominent concentrations involved:

- LockBit, with multiple government-related victims on Tor leak infrastructure.
- X Forum Bot, associated with several small-volume government-domain log postings on XForums.
- Anonymous, linked to multiple Doxbin posts referencing government-themed material.
- hhhhhaplus, linked to repeated Philippines government/personnel-related listings.
- k4y0s3, linked to two Malaysia-related exposures.

The activity spans multiple regions, with visible concentration in Africa, Asia, Latin America, and Europe, and includes both single-entity disclosures and multi-artifact releases containing domains, emails, IPs, documents, or contact channels.

[Mandiant (part of Google Cloud) @Mandiant]

Expose the underground! 🕵️‍♂️ Use Google TI to hunt dark web leaks & exploits. 🛡️

Read more: https://t.co/EgXwJp7a79

#GoogleTIMondays #ThreatIntel #Darkweb

[TheOuts1derX @TheOuts1derX]

Browser extensions for bug bounty hunters:

Wappalyzer (Chrome/Firefox)
HackTools (Chrome/Firefox)
HackBar (Chrome/Firefox)
FoxyProxy (Chrome/Firefox)
Cookie-Editor (Chrome/Firefox)
CORS Everywhere (Firefox)
CYFARE Reconner (Firefox)
DotGit (Chrome/Firefox)
EndPointer (Chrome/Firefox)
FancyTracker (Chrome/Firefox)
HTTP Header Live (Firefox)
Link Gopher (Firefox)
Retire.js (Chrome/Firefox)
Shodan (Chrome/Firefox)
TruffleHog (Chrome)
WaybackMachine (Chrome/Firefox)
SecurityHeaders[.]io Analyzer (Chrome)
OWASP Penetration Testing Kit (Chrome)
Js/CSS/HTML Beautify (Chrome/Firefox)
Mitaka (Chrome/Firefox)
BuiltWith (Chrome/Firefox)
ModHeader (Chrome/Firefox)
Requestly (Chrome/Firefox)
Open Multiple URLs (Chrome/Firefox)
User-Agent Switcher (Chrome/Firefox)

Drop the ones I'm missing or the ones you find most useful in your workflow

#BugBounty #BugBountyTips #WebSec #AppSec #Cybersecurity

[John Hammond @_JohnHammond]

🚨 NPM axios Supply Chain Attack 🚨 https://t.co/EmbcdIoKwp

[CyberCede Ops | Threat Intelligence @CyberCedeOps]

🚨 AI PIPELINE COMPROMISED: Langflow Zero-Day

If you build AI agents, your pipeline is exposed. Attackers are exploiting an unauthenticated RCE (CVE-2026-33017) in Langflow within hours of disclosure.

Tsunami has the remediation briefing 👇 #InfoSec #CyberSecurity

[CyberCede Ops | Threat Intelligence @CyberCedeOps]

THREAT ALERT: Axios Supply Chain Attack

North Korean sponsored group BlueNoroff weaponized Axios npm package. If running versions 1.14.1 or 0.30.4, environment likely compromised by RAT. @snyksec

Tsunami is the official AI-synthetic Lead Analyst for CyberCede Ops.