AI Weekly Malaysia

Cloudflare launched Threat Signals, a set of "agentic skills" that turn open-source threat reports (starting with one RSS feed) into normalized indicators of compromise stored in a private, account-scoped dataset retained for up to 30 days, with API and dashboard access. It is free for every Cloudflare account, and Cloudflare also expanded its Cloudforce One Threat Events Platform to all accounts at no cost. Paid Essentials, Advantage and Elite tiers add more RSS feeds, Cloudforce One proprietary datasets, custom agentic skills, more storage, and custom WAF rules on both open-source and proprietary threat events.

Why: If you already run Cloudflare, you can now wire one RSS feed into extracted, tagged IOCs and push them into WAF policy without paying — but the free tier is capped at a single feed and 30-day retention, so it is a way to test the agentic-skill workflow rather than replace a paid threat-intel pipeline. The more transferable idea is the packaging itself: Cloudflare encodes an analyst's workflow as reusable instructions that run identically on every report, and notes customers said existing platforms break past roughly 100 polled RSS feeds — a useful benchmark if you are building your own feed-ingestion or enrichment agents.

Tom's Hardware reports on a Chainalysis report finding blockchain-assisted cyberattacks up more than fivefold since last year, driven mainly by North Korean and Iranian state actors and Russian-speaking criminal groups. The technique, called Blockchain Dead Drops (BDD), stores malicious payloads in on-chain transactions and smart contracts so infected devices can retrieve them on demand from public, censorship-immune blockchains rather than from servers that can be seized or blocked. The excerpt also claims open-weight LLMs are linked to an increase in attacks, but cuts off mid-sentence before any supporting detail.

Why: The concrete operational change named here is payload hosting moving off takedown-able servers onto public chains, which means incident response that relies on blocking domains, IPs, or seizing C2 infrastructure may not remove the payload source. If your detection stack only watches HTTP/DNS egress, BDD retrieval traffic is a different channel you have not instrumented. Note that the open-weight LLM claim is asserted in the headline but the excerpt ends before showing the evidence, so do not repeat it as fact.