This repository hosts the threat intelligence reports that Accenture Security APEX Labs publishes from Accenture Cyber Intelligence (CI) research into active threats. Each report gives defenders what they need to detect and respond to the threat: indicators of compromise (IOCs), detection rules, network fingerprints and mitigation guidance.
The reports are published as web pages at accenture.github.io/cyber-intelligence. All content is TLP:CLEAR and free to use in your defensive stack.
 Threat analysis Technical findings on malware and attacker tooling |
 Indicators File hashes and IP addresses of known threat activity |
 Detection rules YARA rules for files and memory on Windows and Linux |
 Network fingerprints JA4 and JA3 TLS fingerprints and protocol indicators |
 Mitigation Practical guidance for detection and response |
| Report | Published | Platform |
|---|---|---|
| AI agents weaponizing stolen source code Active, AI-enabled campaign that steals private source code through compromised GitHub Personal Access Tokens and uses AI agents to find and chain novel vulnerabilities |
September 2026 | Any (via GitHub access) |
| Settra Blinder 64-bit Windows EDR evasion toolkit that abuses vulnerable kernel drivers (BYOVD) to blind endpoint defences |
July 2026 | Windows x64 |
| RustyRocket Implant family covering Windows and Linux agents, proxies and the RocketLaunch service installer |
March 2026, updated July 2026 | Windows, Linux |
Indicators. Add the sample hashes to EDR blocklists and SIEM watchlists, and search historical endpoint telemetry for earlier executions. Add IP addresses to firewall and proxy blocklists, and search network and authentication logs for past connections. IP addresses are published defanged (for example, 23.95.119[.]178): replace [.] with . before loading them.
YARA rules. Copy a rule from its report page, save it as a .yar file and run it with the YARA command-line tool. You can also load it into any EDR, sandbox or file-scanning pipeline that accepts YARA rules.
# Scan a directory recursively and print the matching strings
yara -r -s rule.yar /path/to/scan
# Scan the memory of a running process (usually needs administrator or root rights)
yara -s rule.yar <PID>Some rules import YARA modules such as pe or elf, which are included in standard YARA builds.
Network fingerprints. Alert on the JA4 and JA3 fingerprints in your NDR or SIEM pipeline, and prefer JA4 where your tooling supports it. Other software built on the same TLS library can share a fingerprint, so check destination, SNI and host context before blocking.
Mitigation guidance. Each report ends with recommendations specific to the threat. Use them to prioritise hardening and monitoring work.
Test before you block. Run new rules in alert-only mode first to measure false positives in your environment.
All content in this repository is marked TLP:CLEAR under FIRST TLP 2.0. Recipients may share it without restriction, subject to standard copyright rules.
You are welcome to load the indicators and rules into your own tools and to redistribute them. Please credit Accenture Security APEX Labs. Keep the rule metadata (author, date, version) intact so others can trace updates.
If a rule produces false positives, misses a sample it should catch, or a report contains an error, please open an issue. Include the report and rule name, the rule version, your YARA version, and the SHA-256 of any file involved.
Do not attach malware samples to issues, and do not post client, personal or other sensitive data.
Given the inherent nature of threat intelligence, the content contained in this alert is based on information gathered and understood at the time of its creation. It is subject to change. All information and content is provided on an ‘as-is’ basis without representation or warranty and the reader is responsible for determining whether or not to follow any of the suggestions or potential mitigations entirely at their own discretion. Accenture accepts no liability for any action or failure to act in response to the information contained or referenced in this alert.
Copyright © 2026 Accenture. All rights reserved.
Accenture Security APEX Labs (Adversary Pursuit, Engagement, and Exploitation) publishes the reports in this repository. They share indicators, detection rules and mitigation guidance from Accenture Cyber Intelligence research with the wider defender community.
Accenture Cyber Intelligence (CI) provides advanced threat intelligence, adversary research and detection capabilities to help organisations stay ahead of emerging threats.
For more about Accenture's security services, visit Accenture Cybersecurity.