Open Knowledge
Threat analysis by The RabitaNoor (RBTN) Cyber Research Center
Overview of the Platform
Open Knowledge is an open‐source sharing platform that enables tenants of the RBTN - CYOI Pulpit to anonymously contribute threat analyses. This model encourages the open exchange of critical security information, improving situational awareness and collective defense.
The RBTN Ecosystem
RBTN as a Community or Network: The platform is part of the broader RBTN ecosystem—a network that values transparency, community participation, and decentralized decision-making based on open-source principles.
CYOI - RBTN Pulpit: The CYOI - RBTN Pulpit is an AI and big data analytics platform where users create their own CTI to bypass bias. Open Knowledge is a dedicated channel within the RBTN ecosystem for sharing structured threat analyses publicly.
Rubrics (Threat Analysis)
-
Mirai Botnet Exploits Command Injection in TBK DVR Devices
The adversary is leveraging a known vulnerability in TBK DVR devices to expand the Mirai botnet.
-
BADBOX 2.0 Android Malware Campaign Analysis
Cybercriminals exploiting BADBOX 2.0 malware for malicious activities.
-
ConnectWise Breach Linked to Nation-State Hackers
Suspected nation-state actor targeting IT management software.
-
TeleMessage Security Breach Exposes Government Officials
The adversary targeted TeleMessage, a messaging service used by government officials.
-
3AM Ransomware Attack Using Spoofed IT Calls and Email Bombing
The adversary is a 3AM ransomware affiliate using tactics previously linked to the Black Basta ransomware gang.
-
Disruption of Lumma Infostealer Malware Operation and Seizure of 2,300 Domains
Lumma operators are cybercriminals offering malware-as-a-service targeting Windows and macOS systems.
-
Critical Firefox Sandbox Escape Vulnerability on Windows
The adversary is likely a sophisticated cyber-espionage group targeting browser vulnerabilities.
-
Recent Windows Server 2025 updates cause Remote Desktop freezes
An advanced persistent threat group known for targeting financial institutions.
-
Morphing Meerkat Phishing Kit Exploits DNS MX Records to Mimic 114 Brands
The threat actor behind Morphing Meerkat is sophisticated, leveraging DNS MX records and open redirects for targeted phishing attacks.
-
Impact of US Air Strikes on Houthis in Yemen and Cybersecurity Implications
Iran-backed threat actors, including Cyber Av3ngers, Hamas Cyber Unit, and IRGC, are likely to retaliate against Western targets following the US and ...