My threat feed told me it was ‘Chalubo.’ The binary disagreed

I’ve spent two years doing incident response and threat intel, and the one habit I’d keep if I had to give up every other is also the most boring. I don’t act on a piece of intelligence until I’ve checked it against the thing it claims to describe. Almost nobody does it, because checking costs the exact time the feed was supposed to save.