Long-tail threat and malware research from Kaspersky GReAT
securelist.comen
CrowdStrike Blog
Endpoint-driven adversary intelligence and incident reports
crowdstrike.comen
SentinelOne Labs
Malware reverse engineering and threat hunting
sentinelone.comen
Google Security Blog
Google online security research - APT analysis, vulnerability disclosures, and platform threat intelligence from Google + Mandiant.
Google Security Blogen
Microsoft Security Blog
Microsoft Threat Intelligence, Defender research, and cloud security advisories
microsoft.comen
Sophos News
Sophos X-Ops threat research, malware analysis, and defensive guidance
sophos.comen
Trend Micro Research
Trend Micro Zero Day Initiative, APT research, and vulnerability analysis
trendmicro.comen
WithSecure Labs
WithSecure (F-Secure) threat research, adversary tradecraft, and detection engineering
withsecure.comen
AWS Security Blog
AWS threat research, cloud security best practices, and incident response
aws.amazon.comen
InfoStealers.com (Hudson Rock)
Infostealer research, campaign tracking, and weekly reports from the Hudson Rock cybercrime intelligence team - RedLine, Lumma, Vidar, StealC, and emerging stealer families.
infostealers.comen
InfoStealers.com - All Content
All infostealers.com content - blog, reports, and techniques combined feed.
infostealers.comen
InfoStealers.com - Weekly Reports
Infostealers weekly threat reports from Hudson Rock - compromised machine counts, top domains, trending families.
infostealers.comen
InfoStealers.com - Techniques
Infostealer technique profiles from Hudson Rock - Formbook, LummaC2, Aurora, and other stealer TTPs.
infostealers.comen
Dark Web Informer
Daily dark web intelligence, ransomware leak-site posts, breach reports, and underground chatter
darkwebinformer.comen
The Hunter's Ledger
Original threat intelligence research - malware analysis, open-directory investigations, IOC feeds, and hunting detections
the-hunters-ledger.comen
Ransomware.live
Active ransomware victim and leak-site tracker, updated continuously
ransomware.liveen
BleepingComputer · Data Breaches
BleepingComputer breach coverage via main feed - renamed 2026-05; was a separate category feed that now 404s
bleepingcomputer.comen-US
HackRead · Data Breaches
HackRead breach reporting - covers global incidents with notable focus on India + emerging markets
CyberScoop - US government + enterprise cyber incident coverage, breaches, indictments
cyberscoop.comen
DataBreaches.net
Breach reporting and analysis from Dissent. Wide coverage of healthcare, education, and government incidents
databreaches.neten
The DFIR Report
In-depth incident response writeups with full IOC and TTP detail
thedfirreport.comen
The Record
Cybersecurity reporting from Recorded Future, with strong dark web and ransomware coverage
therecord.mediaen
Google Project Zero
Zero-day vulnerability research from the Google Project Zero team
googleprojectzero.blogspot.comen
Check Point Research
Malware reverse engineering and active campaign tracking from Check Point
research.checkpoint.comen
Malwarebytes Labs
Consumer and enterprise malware research from Malwarebytes Labs
malwarebytes.comen
Huntress Blog
Detection content and incident reports from the Huntress threat ops team
huntress.comen
Red Canary
Detection engineering and threat intel from the Red Canary team
redcanary.comen
Malware Traffic Analysis
Brad Duncan's daily PCAPs, IOCs, and malware samples. One of the highest-signal IOC feeds online
malware-traffic-analysis.neten
MITRE ATT&CK
Official updates from the MITRE ATT&CK team on framework changes and threat groups
medium.com/mitre-attacken
DFIR Lab
Digital forensics and incident response research, threat analysis, and case studies
DFIR Laben-US
DFIR Radar
Security advisories and threat intelligence from the DFIR Radar project
DFIR Radaren-US
SANS Internet Storm Center
Daily handler diaries and security threat intelligence
SANSen-US
Recorded Future Blog
Recorded Future threat research - threat intel, APT tracking, and strategic analysis
recordedfuture.comen-US
RedHunt Labs Research
Attack surface management research, vulnerability disclosures, and APT infrastructure tracking by RedHunt Labs
research.redhuntlabs.comen
rekt.news
Long-form post-mortems of major DeFi exploits, rug pulls, and protocol failures
rekt.newsen
Web3 Is Going Just Great
Molly White's running ledger of crypto scams, rug pulls, and grift incidents
web3isgoinggreat.comen-US
vpnMentor Research Lab
vpnMentor research lab - discovered and reported breaches, particularly in exposed-database / misconfigured-cloud territory
vpnmentor.comen
GRC Solutions · Data Breach Blog
GRC Solutions (formerly IT Governance UK) - monthly breach round-ups + analysis of high-profile data-protection incidents
grcsolutions.ioen-GB
Comparitech · Privacy Research
Comparitech privacy / breach research - Bob Diachenko-style exposed-database investigations and breach reporting
comparitech.comen
Troy Hunt · HIBP blog
Troy Hunt's personal blog - write-ups of every Have I Been Pwned acquisition, plus deep dives on credential-stuffing, breach pricing, and the post-leak data-broker ecosystem.
troyhunt.comen
Graham Cluley
Graham Cluley - independent security blog covering data breaches, malware, and cybercrime.
grahamcluley.comen
MalwareTech Blog
MalwareTech (Marcus Hutchins) - malware analysis, reverse engineering, and threat research from the person who stopped WannaCry.
malwaretech.comen
Hexacorn
Hexacorn - deep-dive reverse engineering, rootkit analysis, and creative security research by Amr Thabet.
hexacorn.comen
Objective-See
Objective-See (Patrick Wardle) - macOS/iOS threat research, Apple security vulnerabilities, and malware analysis.
Wordfence - WordPress malware campaigns, plugin vulnerabilities, and threat intelligence.
wordfence.comen
Identity Theft Resource Center
ITRC - non-profit that tracks U.S. publicly-reported data breaches; publishes quarterly + annual reports on breach trends, victim counts, and notification compliance.
idtheftcenter.orgen
Google News - India cyber attacks & breaches
India-scoped Google News for cyber-attacks, data breaches, ransomware incidents and APT activity targeting Indian organisations.
Google News (IN)en-IN
CERT-In advisories (via Google News)
Coverage of CERT-In (Indian Computer Emergency Response Team) advisories, vulnerability notes and alerts - CERT-In has no stable public RSS, so this tracks it via news.
Google News (IN)en-IN
Cyble Research
Threat intelligence research - dark-web monitoring, ransomware, breach and campaign analysis
cyble.comen
SOCRadar
Dark-web and external attack-surface threat research, leak and ransomware tracking
socradar.ioen
BushidoToken
Independent CTI research - ransomware, dark-web actors, campaign deep-dives
blog.bushidotoken.neten
Rapid7 Blog
Vulnerability research, emergent-threat advisories and detection guidance
gnews-cyber— google news rate-limits Worker IPs, 503 (2026-05-24)
gnews-india— google news rate-limits Worker IPs, 503 (2026-05-24)
gnews-ai— google news rate-limits Worker IPs, 503 (2026-05-24)
gnews-cloud— google news rate-limits Worker IPs, 503 (2026-05-24)
gnews-devsecops— google news rate-limits Worker IPs, 503 (2026-05-24)
gnews-ics— google news rate-limits Worker IPs, 503 (2026-05-24)
gnews-iot— google news rate-limits Worker IPs, 503 (2026-05-24)
gnews-mobile— google news rate-limits Worker IPs, 503 (2026-05-24)
gnews-ransomware— google news rate-limits Worker IPs, 503 (2026-05-24)
gnews-supply-chain— google news rate-limits Worker IPs, 503 (2026-05-24)
How feed management works
Disabling a feed hides it from the aggregated feed view. The server-side fetch still runs - this toggle controls display only, stored in your browser localStorage.
To add a new feed source, edit src/data/rssFeeds.ts and add its URL to the ALLOWED_HOSTS list in api/src/routes/feeds.ts and feeds-aggregate.ts.