“We find many things that others do not even see”

This article profiles a Group-IB Threat Intelligence analyst, outlining his work tracking APT groups, infrastructure-hunting methodologies (e.g., using SSL certificate patterns to identify Cyclops Blink-infected WatchGuard devices), and views on collaboration and data-driven security. It reflects on case experiences with groups like APT32, APT41, and MuddyWater, highlights the importance of engineering neutrality and community knowledge-sharing, and includes notes on training, teaching, and career advice in threat intelligence, alongside links to company resources and vacancies.