Untitled Blog Post

--- title: "The Minnesota Threat Intelligence Gap (And Why We're Filling It)" subtitle: "5 Days, 51 Pulses, 5,186 IOCs - A Startup's Journey Into Cyber Defense" date: 2025-12-03 author: Patrick Duggan tags: [threat-intelligence, startup, seed-funding, otx, pattern-38, ransomware] ---

The Gap Nobody's Filling

Here's a dirty secret about threat intelligence: the big players are drowning in legacy malware signatures while fresh threats slip through GitHub every hour.

AlienVault has 566,000 indicators. Impressive. But scroll through - you'll find Berbew (a 2018 banking trojan), Skype worms from 2015, and 24,000+ generic "trojan" entries that help exactly nobody.

• `Thrbvbb` - Crypto wallet drainers

• `Aestrpljabt` - Fake balance tools

• `HangTheDrt` - Electrum phishing kits

By 6 PM Central, we'd published IOCs. By tomorrow, they'll probably be suspended. That's the gap.

What We Actually Do

DugganUSA LLC is a Minnesota-based threat intelligence operation. Two guys, a Claude Code subscription, and an unhealthy obsession with GitHub malware.

Our Niche: Pattern 38 Supply Chain Attacks

• Fake software cracks ("Adobe-Premiere-2025-Crack")

• Open source project issue comments with malicious ZIPs

• Bot farms (800+ repos, mechanical timing)

• Follower networks that amplify malware reach

We call it Pattern 38. We've documented 40+ variations.

The Numbers (5 Days In)

| Metric | Count | |--------|-------| | OTX Pulses | 51 | | Indicators Published | 5,186 | | Subscribers | 14 | | GitHub Accounts Reported | 47 | | Accounts Subsequently Suspended | 12 | | Ransomware Families Covered | 11 | | Time to IOC Publication | <4 hours |

Our Unique Methodology

1. Pattern 42 "Reblessing" - We follow threat actor social graphs. One RAT author leads to their followers, who lead to their tools, which lead to C2 infrastructure.

2. Same-Day Detection - Account created at 5 PM? We've got a pulse by 9 PM.

3. CISA-Sourced Ransomware Intel - LockBit, BlackCat, Rhysida, Cl0p - all with official advisory references.

4. Judge Dredd Disclosure - We post warnings directly on malicious repos. "I AM THE LAW."

Why This Matters

Every crypto drainer we catch saves someone's retirement. Every RAT builder we report prevents a hospital from getting pwned. Every C2 IP we publish helps a SOC analyst sleep better.

• 4 malware droppers suspended (FireSuper, rampubg14-cmyk, anuxagfr, winchmrsmilegodsgf)

• 1 C2 IP blocked (149.102.156.62 - Contabo/Rhadamanthys)

• 16 GitHub repos warned with evidence

The Business Model

Free threat intel builds reputation. Reputation builds subscribers. Subscribers become customers.

• Real-time GitHub malware alerts (API)

• Custom threat hunting for your supply chain

• Incident response with Pattern 38 expertise

• STIX feed integration for enterprise SIEMs

We're Looking for Seed Funding

Here's the honest pitch:

• Proven methodology (51 pulses in 5 days)

• Growing OTX subscriber base (14 and climbing)

• Automated detection pipeline (GitHub Actions, daily scans)

• Domain expertise (Pattern 38-42 taxonomy)

• Zero overhead (Minnesota garage operation)

• $150K seed to go full-time

• ThreatFox API access ($$$)

• VirusTotal Enterprise ($$$)

• One more analyst

• Equity in the only company doing systematic GitHub supply chain threat intel

• First-mover advantage in an underserved market

• Two founders who ship faster than your last three acquisitions

Contact

Patrick Duggan DugganUSA LLC [email protected] Minnesota, USA

• OTX: [pduggusa](https://otx.alienvault.com/user/pduggusa)

• STIX Feed: analytics.dugganusa.com/api/v1/stix-feed

• Blog: www.dugganusa.com

---

*"Feed subscribers get IOCs first. Bad actors get public shaming second. Investors get returns third."*

*- The DugganUSA Way*

---

Get Free IOCs

Subscribe to our threat intelligence feeds for free, machine-readable IOCs:

AlienVault OTX: https://otx.alienvault.com/user/pduggusa

STIX 2.1 Feed: https://analytics.dugganusa.com/api/v1/stix-feed

Questions? [email protected]