New Validin Docs, a Russian Panda, and Christmas Intel

Before your regularly scheduled monthly threat intel newsletter...

Thank you for being part of our growth this year 💙

Because of your support, feedback, and advocacy, Validin has had another year of progress.

Here are a few of the platform improvements you helped make possible:

🚀 Launching YARA rule hunting

⬆️ Completing substantial upgrades to crawling history and artifact collection

👤 Adding in-depth threat actor profiles

➕ and more

Your support also helped us:

🌱 Grow our team

✉️ Launch this monthly newsletter (and a Discord community)

⏰ Spend time with some of you at PIVOTcon, Sleuthcon, and LABScon

🤝 Collaborate with other brilliant threat research teams, journalists (twice), and partners

We’re looking forward to another year of supporting threat intelligence, platform updates that enable advanced threat tracking and research, and exciting collaborations and partnerships. If you have any feedback or ideas for what you want to see in 2026, reply to this email.

Sincerely,
The Validin Team

PLATFORM UPDATE

Comprehensive Documentation

Highlights:

• Fully rewritten documentation with comprehensive coverage across integrations, data sources, platform features, API usage, and account management
• Unified search across the entire knowledge base
• Available now at docs.validin.com

👉 Read the complete update blog now

✨ VIBE HUNTING

Watch our interview with Anna P.

Validin's Founder Kenneth Kinion was interviewed by Senior Hunt and Response Analyst at Huntress and cybersecurity YouTuber, Anna P., who later goes ✨ vibe hunting ✨ with Edward Crowder within the platform.

👉 Watch the full video

FEATURED IN

💳 Christmas Heist: Analysis of Trust Wallet Browser Extension Hack

Threat intelligence firm SlowMist provides a technical analysis on Trust Wallet’s recent browser extension security risk disclosure. Read the report now.

🎣  Christmas Tycoon: Tales From the Phishing Factory With Over 1.9k Domains

Vasilis Orlof traces a single phishing lure to a large automated phishing operation, pivoting on shared infrastructure fingerprints to uncover 1,900+ related domains across five “template” campaigns. Read the full article.

🕵️ Budget Threat Hunting: Tracking Adversary Infrastructure with ValidIn and URLScan.io

The Huskyscripts Blog shares threat hunting techniques using crowdsourced and freemium tools, including Validin. Access the guide.

🌩️ FlexibleFerret Malware Continues to Strike

Jamf Threat Labs expands on DPRK-linked FlexibleFerret campaign, warning they are still actively targeting macOS via fake job scams. Read their research.

BY THE NUMBERS

December's Top Viewed Threat Actor Profiles and their position change from last month. If you're logged into Validin, view the full profiles:

1. ClickFix (no change)
2. APT38 (new)
3. Lumma Stealer (+1)
4. Lazarus Group (-1)
5. Kimsuky (new)