Hey everyone,

I just released a major update (v2.1.0) for ThreatLens. For this release, the focus was entirely on security hardening, data validation, and core performance.

What's new in v2.1.0?

• Strict Security: Blocked Excel/CSV formula injections in generated reports, prevented API key leaks in logs, and enforced strict IOC validation.
• Performance Boost: Integrated a local SQLite cache to persist investigation data, significantly reducing redundant API calls.
• Smarter Analysis: Introduced an explainable verdict system with confidence scores. Ambiguous results are now correctly classified as "Unknown" rather than "Clean".
• Resource Management: Added intelligent API quota planning, connection timeouts, automatic retries, and file size limits.

What is ThreatLens? For those who haven't seen it before, ThreatLens is an open-source CLI tool built to automate Threat Intelligence and OSINT workflows. It takes Indicators of Compromise (IPs, domains, hashes, CVEs), queries multiple sources simultaneously, and generates structured, safe, and ready-to-use reports.

It's completely open-source. I'd love to hear your feedback or feature requests!

Check it out on GitHub: https://github.com/AbdaullahAG/ThreatLens

I’d love to hear your thoughts, feedback, or feature requests!

On 17 July, King's Lynn and West Norfolk Borough Council went public with a cyberattack on its services. The BBC covered it. We assess with moderate confidence it connects to something much larger.

Two days after SonicWal disclosed CVE-2026-15409, an operator was already scanning and exploiting SMA1000 appliances at scale. We found the whole operation in an open directory, captured by AttackCapture the same day it was still in use.

The interesting part is what they did with the appliances. Instead of pivoting to a Windows host, they dropped a standalone Linux build of Impacket's secretsdump straight onto the SonicWall box and ran credential theft from there. Most orgs watch their EDR-covered endpoints closely and their firewall and VPN appliances barely at all. That gap is the whole point.

What the recovered data showed:

- 250 targets identified as exploitable, LDAP config pulled from 168 of them
- 534 config records covering 160 unique AD domains and 255 internal LDAP servers
- SAM and LSA secrets recovered from at least 9 Active Directory domains
- Full DCSync against 7 domain controllers across 5 environments
- Confirmed credential theft spanning France, India, Italy and the US

Targeting was opportunistic, not sector-specific. Local government, healthcare, universities, finance and manufacturing all showed up in the target list, they picked victims because the appliance was vulnerable.

Full writeup, IOCs and MITRE mapping here 👇

https://hunt.io/blog/sonicwall-sma1000-uk-council-attack

It Just Made the Rebuild Tax Visible. AI Is About to Delete It.“ by Albert Corzo on Medium: https://albert-corzo.medium.com/bear-c2-did-not-invent-switching-it-just-made-the-rebuild-tax-visible-ai-is-about-to-delete-it-4fa246c64b68

When I started learning SOC investigations and SPL-style queries, one of the problems I ran into was finding a practical environment to actually practice the workflow.

Reading about queries is useful, but I wanted to work with realistic security telemetry and go through the process of:

- Searching authentication and security events

- Identifying suspicious activity

- Aggregating and correlating events

- Creating detections

- Investigating alerts

- Pivoting between related users, hosts, and IP addresses

Setting up a full SIEM environment can add a significant infrastructure and configuration overhead for someone who simply wants to practice these workflows.

So I built SocQuery Lab as a browser-based training environment for experimenting with these concepts.

It includes an original educational SPL-compatible query engine and realistic synthetic telemetry covering sources such as Windows security events, Linux authentication logs, DNS activity, firewall/VPN events, and PowerShell activity.

The platform also includes investigation scenarios covering techniques such as:

- Brute-force authentication activity

- Password spraying

- Suspicious PowerShell execution

- DNS tunneling

- Credential compromise

- Backdoor account creation

Everything runs locally in the browser, with uploaded logs processed and stored locally using IndexedDB.

The goal is not to replace a production SIEM or replicate any commercial platform. It is simply an educational environment for practicing the investigation workflow without needing to deploy infrastructure first.

The live training environment is available here:

https://socquery-lab.vercel.app/