Welcome to my Cyber Threat Intelligence (CTI) and Malware Analysis repository.
I am a Cybersecurity Professional specializing in Threat Intelligence. This repository serves as a live portfolio showcasing my practical application of intelligence lifecycles, threat modeling, and defensive methodologies. The content here demonstrates my ability to translate technical analysis into actionable intelligence, aligning with industry standards like the MITRE ATT&CK framework.
/Reports: Tactical and strategic threat analysis reports. Includes deep dives into malware campaigns, infection chains, and actionable mitigation strategies./Scripts_and_Tools: Python automation scripts designed to accelerate the intelligence collection phase, including automated IOC enrichment leveraging external APIs./YARA_Rules: Custom YARA rules written to detect specific malware families, offensive tools, and campaign-specific artifacts based on host and network indicators.
- ClickFix Technique - Threat Analysis: A comprehensive tactical report detailing the execution chain of a fileless RAT distributed via fake CAPTCHA social engineering.
- IOC Enricher Automation: A Python utility that automatically cross-references indicators of compromise against VirusTotal and Shodan to identify threat actor infrastructure exposure.
- ClickFix RAT Detection Rule: A robust YARA rule engineered to detect evasive PowerShell execution and Base64 obfuscated payloads associated with the ClickFix campaign.
🆕 Latest Landscape Report: LATAM Ransomware Overview 2025-2026 A comprehensive threat intelligence report detailing the operational shift of major ransomware groups (Qilin, The Gentlemen, LockBit 5.0, Akira, DragonForce, INC Ransom) targeting LATAM. The analysis highlights a critical pivot towards exploiting perimeter devices and edge infrastructure vulnerabilities over traditional phishing.
- 📄 Full Report: Ransomware Landscape 2025-2026
- Key Topics:
Edge Exploitation,Ransomware-as-a-Service (RaaS),BYOVD,VPN/Firewall Vulnerabilities,LATAM Threat Landscape,RaaS.
An in-depth technical analysis of ENCFORGE, a compiled Go ransomware deployed by the JADEPUFFER threat actor, specifically designed to target and destroy Artificial Intelligence and Machine Learning infrastructure (model weights, vector databases, and training pipelines).
- 📄 Full Report & TTPs: ENCFORGE Ransomware Threat Intel Report
- 🛡️ Detection Engineering: ENCFORGE YARA Rule
- Key Topics:
Container Escape,AI/ML Targeting,Ransomware,Docker Socket Abuse,Go Malware.
Feel free to explore the repository. If you want to discuss threat intelligence, share insights, or collaborate on a project, you can reach out to me:
- LinkedIn: Hernan Diaz Veas