Agentic AI collects it. Analysts verify it. Community acts on it.

Overview

When a serious attack breaks, the indicators SOC teams need are scattered across reports, often buried in PDFs and in formats no security tool can load directly. Commercial feeds are expensive and bury the attacks that matter under low-value indicators, and most teams do not have time to dig through every source themselves. This project does that work once, for everyone, focusing on attacks against banking, insurance and financial services, UK organisations and critical systems such as identity providers, edge devices and core enterprise software. Each threat comes with a short research summary, curated indicators that each have a description and a source, and ready-to-use block lists, Defender XDR import files and hunt queries.

[!CAUTION] Handle all indicators as live and malicious. Do not visit, open, download or resolve any IP address, domain, URL or file listed here from a corporate or personal device. Analyse them only in an isolated environment, such as a hosted sandbox like ANY.RUN or a self-hosted one like…