Home › Blog

#ninjasignal update: Every adversary leaves fingerprints.

#ninjasignal update: Every adversary leaves fingerprints.

We just keep insisting on reading them as spreadsheets.

This app started as a refusal.
A refusal to believe that threat intelligence is best understood as lists, feeds, or dashboards that politely decay the moment you stop looking at them.

So instead, I’m building a knowledge graph.
Not a metaphorical one.
An actual one.

Threat actors, campaigns, tooling, infrastructure, motives — all represented as nodes, not bullet points.

Relationships treated as first-class citizens, not footnotes.

Time, intent, reuse, drift, obsession — modeled the way attackers actually think.

Scattered Spider makes a good screenshot here.
Not because they’re special.
But because they’re legible when you stop flattening them.

Psychology matters.

Attackers don’t operate like CVEs.
They operate like humans with fixations, habits, boredom thresholds, and reward loops.
Like organisms probing for dopamine, leverage, and narrative control — not “IOCs.”

Graphs understand this instinctively.

Signals emerge without asking permission:
When tradecraft starts to repeat compulsively
When infrastructure reuse looks less like efficiency and more like comfort
When campaigns mutate but personality stays the same
When silence itself becomes an indicator

Later, the same graph becomes something more uncomfortable:
A shared backend where IT assets sit in the same ontology as adversaries.
Not red team vs blue team.
Just pressure moving through a system.

The long-term aim isn’t prediction.
It’s orientation.
To see who moves like an addict.
Who moves like a planner.
Who improvises.
Who panics.
Who can’t let go of a successful trick even after it burns them.

Entropy with a résumé.

I’m opening this up — selectively — to people who want to test it, break it, critique it, or tell me why it’s a terrible idea.

Field feedback > polite applause.

Because if we’re going to keep pretending security is about control,
we should at least build systems that admit how much of it is about obsession.

And how predictable obsession becomes once you stop lying to yourself about it.

scottg/out

DM me or [email protected] re: the above

The Probably Fine Daily

Threat intelligence every morning — new victims, new groups, what matters, in plain English. Free, with receipts.

Subscribe to the Daily →

View the original on LinkedIn ↗

← All writing