Sources & Methods Newsletter #25 - August 2025
Hello again! I'm glad to share this month that I joined Remitly to help build their Threat Intelligence program, ensuring the safety and security of a vital financial service for millions around the world.
Hope you're all doing well,
Matthew Conway (@mattreduce)
📁 Sources
FT3 - Stripe just open sourced a framework they call FT3, or "Fraud Tools, Tactics and Techniques." The ATT&CK-inspired taxonomy is meant to aid understanding and cataloging financial crimes and other kinds of fraud. Contributions are welcome.
📰 Information
Unit 42 - Introducing Unit 42's Attribution Framework #attribution #frameworks
Vertex Project - Using Tactical and Strategic Analysis to Track Threat Actor Targeting #tooling #tracking
Joe Slowik - Will the Real Salt Typhoon Please Stand Up #attribution #targeting
CheckFirst - Decoding Secrets Through Symbols: How Military Insignia Revealed Russia's Hidden SIGINT Network #RU #SIGINT #actors
MITRE - Vizualize, Understand, and Share with Attack Flow 3 #frameworks #tooling
Nicholas Peterson - Trust But Verify: Evaluating the Accuracy of LLMs in Normalizing Threat Data Feeds #tooling #LLM #research
DomainTools - Mapping Hidden Alliances in Russian-Affiliated Ransomware #ransomware #RU #infographics
Abuse.ch - Creating sustainability for abuse.ch and its community #sources
🛠 Tools
Thorium
New file analysis platform from CISA for building pipelines of analysis tools with full-text searchable results.
Flowintel
github.com/flowintel/flowintel
New open source web app for organizing threat intelligence from case management and tasks to templates, with MISP integration.
vim-storm
Vim syntax highlighting for the Storm query language (Vertex Synapse).
Fabric
github.com/blackstork-io/fabric
An open source CLI tool for creating various security-related reports from templates with LLM capabilities.
helm-opencti
github.com/devops-ia/helm-opencti
If you use Kubernetes or have a DevOps team that does, here's a Helm Chart that will simplify OpenCTI deployment for you.
📆 Events
Underground Economy
📍 Strasbourg, FR
📆 September 1-4th, 2025
🔗 https://www.team-cymru.com/gate/underground-economy-2025
ATT&CKcon 6.0
📍 McLean, VA, US
📊 October 14-15th
🏢 MITRE ATT&CK HQ
🔗 https://na.eventscloud.com/website/82912/
State of Statecraft
CFP closes September 1st, 2025
📍 Bruxelles, BE
📆 October 28th, 2025
🏢 Location will be shared after registration
🔗 https://www.stateofstatecraft.com/
🔗 CFP https://www.stateofstatecraft.com/cfp
RISE Malaysia
📍 Putrajaya, MY
📆 December 9-10th, 2025
🔗 https://www.team-cymru.com/events
Member discussion