Detection Method: Threat intelligence

Threat intelligence uses data feeds and insights about known and emerging phishing threats to give you proactive protection against attackers. This method taps into massive databases of indicators of compromise (IoCs), helping your security systems recognize patterns, techniques, and infrastructure that have been seen in past attacks.
Threat intelligence can help you identify:
  • Domains and URLs linked to previous phishing campaigns
  • File hashes associated with known malware samples
  • IP addresses connected to command and control servers
  • Email patterns that match identified threat actors
  • Emerging threats based on recently observed attack tactics
For example, when a new phishing campaign targeting a specific industry is discovered, threat intelligence feeds can share the indicators of that campaign, so you can block similar attempts before they even reach your users.
Blog Post
Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security
Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security
A brief background of PikaBot with a focus on recently observed attack techniques and email detection methods.
Attack Types (2):
Credential Phishing
Malware/Ransomware
Tactics & Techniques (7):
Evasion
Free file host
Free subdomain host
Open redirect
Social engineering
PDF
Impersonation: Brand
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Service abuse: Google OAuth with suspicious redirect destination
2d ago
Mar 12th, 2026
Sublime Security
Credential Phishing
Evasion
Free file host
Free subdomain host
Open redirect
Social engineering
URL analysis
Threat intelligence
Attachment: PDF Object Hash - Encrypted PDFs with fake payment notification
12d ago
Mar 2nd, 2026
Sublime Security
Malware/Ransomware
PDF
Evasion
File analysis
Threat intelligence
Link: URL redirecting to blob URL
18d ago
Feb 24th, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
Evasion
Free file host
Open redirect
Sender analysis
URL analysis
Threat intelligence
Link: 9WOLF phishkit initial landing URI
1mo ago
Jan 30th, 2026
Sublime Security
Malware/Ransomware
Evasion
URL analysis
Threat intelligence
URLhaus: Malicious domain in message body or pdf attachment (trusted reporters)
2mo ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
PDF
File analysis
Threat intelligence
URL analysis
MalwareBazaar: Malicious attachment hash (trusted reporters)
2mo ago
Jan 12th, 2026
Sublime Security
Malware/Ransomware
File analysis
Sender analysis
Threat intelligence
MalwareBazaar: Malicious attachment hash in archive (trusted reporters)
8mo ago
Jul 16th, 2025
Sublime Security
Malware/Ransomware
Evasion
Archive analysis
File analysis
Sender analysis
Threat intelligence
Malware: Pikabot delivery via URL auto-download
2y ago
Apr 25th, 2024
Sublime Security
Malware/Ransomware
Evasion
Archive analysis
File analysis
Threat intelligence
URL analysis
Brand impersonation: ukr[.]net
3y ago
Aug 21st, 2023
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Sender analysis
Threat intelligence