Detection Method: Threat intelligence

Threat intelligence uses data feeds and insights about known and emerging phishing threats to give you proactive protection against attackers. This method taps into massive databases of indicators of compromise (IoCs), helping your security systems recognize patterns, techniques, and infrastructure that have been seen in past attacks.

Threat intelligence can help you identify:

Domains and URLs linked to previous phishing campaigns
File hashes associated with known malware samples
IP addresses connected to command and control servers
Email patterns that match identified threat actors
Emerging threats based on recently observed attack tactics

For example, when a new phishing campaign targeting a specific industry is discovered, threat intelligence feeds can share the indicators of that campaign, so you can block similar attempts before they even reach your users.

Blog Post

Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security

A brief background of PikaBot with a focus on recently observed attack techniques and email detection methods.

Attack Types (2):

Malware/Ransomware

Credential Phishing

Tactics & Techniques (8):

Rule Name & Severity	Last Updated	Author	Types, Tactics & Capabilities
Link: Landing page with search-ms protocol redirect	13d ago Apr 7th, 2026	Sublime Security	Malware/Ransomware Evasion Scripting URL analysis Threat intelligence
MalwareBazaar: Malicious attachment hash (trusted reporters)	25d ago Mar 26th, 2026	Sublime Security	Malware/Ransomware File analysis Sender analysis Threat intelligence
Service abuse: Google OAuth with suspicious redirect destination	1mo ago Mar 12th, 2026	Sublime Security	Credential Phishing Evasion Free file host Free subdomain host Open redirect Social engineering URL analysis Threat intelligence
Attachment: PDF Object Hash - Encrypted PDFs with fake payment notification	1mo ago Mar 2nd, 2026	Sublime Security	Malware/Ransomware PDF Evasion File analysis Threat intelligence
Link: URL redirecting to blob URL	1mo ago Feb 24th, 2026	Sublime Security	Credential Phishing Malware/Ransomware Evasion Free file host Open redirect Sender analysis URL analysis Threat intelligence
Link: 9WOLF phishkit initial landing URI	2mo ago Jan 30th, 2026	Sublime Security	Malware/Ransomware Evasion URL analysis Threat intelligence
URLhaus: Malicious domain in message body or pdf attachment (trusted reporters)	3mo ago Jan 12th, 2026	Sublime Security	Credential Phishing Malware/Ransomware PDF File analysis Threat intelligence URL analysis
MalwareBazaar: Malicious attachment hash in archive (trusted reporters)	9mo ago Jul 16th, 2025	Sublime Security	Malware/Ransomware Evasion Archive analysis File analysis Sender analysis Threat intelligence
Malware: Pikabot delivery via URL auto-download	2y ago Apr 25th, 2024	Sublime Security	Malware/Ransomware Evasion Archive analysis File analysis Threat intelligence URL analysis
Brand impersonation: ukr[.]net	3y ago Aug 21st, 2023	Sublime Security	Credential Phishing Impersonation: Brand Social engineering Sender analysis Threat intelligence

Attack Types

Tactics and Techniques

Detection Methods

Detection Method: Threat intelligence