When $100B in Market Cap Reads Your Free Feed

The Scoreboard

Two companies worth a combined $100 billion.

Same attack patterns we published two months earlier.

The timestamps don't lie.

---

Zscaler's "NodeCordRAT"

On January 7, 2026, Zscaler ThreatLabz announced they had "uncovered" a new malware family called NodeCordRAT:

• npm supply chain delivery
• Discord C2 communication
• Chrome credential theft
• MetaMask/crypto wallet targeting
• API token exfiltration

Groundbreaking stuff. Except we published the exact same TTPs on November 25, 2025 in our Stealc/Rhadamanthys analysis.

We called it Anusfragger.

We wrote a metal song about it.

The song is timestamped on Suno. The blog post is timestamped on Wix. The IOCs are timestamped in our STIX feed.

Zscaler gave it a boardroom-safe name and a press release.

---

Unit 42's "Attack Chain Targeting Users Looking for Legitimate Tools"

On January 22, 2026, Palo Alto's Unit 42 published research on an attack chain using:

• GitHub repositories masquerading as legitimate tools
• Malicious ZIP archives
• Fake/sleeper accounts
• SEO poisoning to drive victims to malicious repos

Sound familiar?

We published "Hall of Shame: FireSuper - GitHub Supply Chain Sleeper Account" on November 23, 2025.

We published "The Mentat's Analysis: Who's Behind Pattern 38?" on November 25, 2025.

Same TTPs. Same attack vector. Same pattern.

60 days earlier.

---

The TTP Comparison

Discord Infostealers (Zscaler vs Us)

It's the same thing with a different name.

GitHub Supply Chain (Unit 42 vs Us)

It's the same thing with a different report number.

---

How This Works

1. We investigate - Pattern 38, supply chain attacks, Discord C2
2. We publish - Blog posts, STIX feed, OTX pulses (all free, all timestamped)
3. Vendors scrape feeds - That's what threat intel aggregation is
4. Vendors "discover" - 4-8 weeks later
5. Vendors rebrand - "NodeCordRAT" instead of "Anusfragger", "Attack chain" instead of "Pattern 38"
6. Enterprise pays - $420K/year for rebranded free intel
7. We publish receipts - You are here

---

The Math Your CFO Should See

What They Charge

What We Charge

For $770K/year combined, you get research we published for free two months earlier.

---

The Attribution Laundering Problem

• Google returns zero results before January 2026
• The prior art disappears
• The free source gets erased
• The paid version becomes "original research"

• The pattern number that tracks to our blog vanishes
• The GitHub sleeper account research we published gets buried
• The timeline of discovery gets rewritten

Renaming isn't just marketing. It's attribution laundering.

---

The Receipts

Our Publications (November 2025)

Their Publications (January 2026)

The timestamps are public. The Wayback Machine exists. Web archives don't lie.

Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →

---

What This Means For You

If you're a threat intel consumer:

1. Subscribe to primary sources - Not just vendor blogs
2. Check publication dates - Who published first?
3. Follow independent researchers - We exist, and we publish free
4. Question "discoveries" - Most are correlations of existing intel
5. Do the math - Is $770K/year worth 60 days of delay?

---

The Alternative

STIX 2.1 Feed: https://analytics.dugganusa.com/api/v1/stix-feed

• 312,000+ IOCs
• 39 countries consuming
• Updated continuously
• MITRE ATT&CK mapped
• Cost: $0

OTX Profile: https://otx.alienvault.com/user/pduggusa

• #2 All-Time Contributor
• 1,000,000+ indicators
• 75 subscribers (including enterprise SOCs)
• Cost: $0

The feed they're reading. The feed you could be reading directly.

---

The Point

We're not competing with Zscaler or Palo Alto. We can't. They have thousands of employees. We have two people and a STIX feed.

But we can document. We can timestamp. We can publish receipts.

And we can keep pointing out that the emperor's "new research" was in our free feed two months ago.

---

The Closing Argument

$100 billion in market cap.

Same patterns we published for free.

Two months later.

The timestamps don't lie.

---

Patrick Duggan is founder of DugganUSA LLC, a Minnesota-based threat intelligence operation that publishes free IOCs because defenders shouldn't have to pay for intel that's already public.

His name is Anusfragger. Their name is NodeCordRAT. Check the timestamps.

---

Get Free IOCs

• STIX Feed: https://analytics.dugganusa.com/api/v1/stix-feed
• OTX: https://otx.alienvault.com/user/pduggusa
• Blog: https://www.dugganusa.com

TLP:WHITE - Share freely. Credit appreciated but not required (unlike some vendors, we don't pretend to discover things we read in feeds).

---

Her name was Renee Nicole Good.

His name was Alex Jeffery Pretti.

---

The cheapest, fastest, most accurate threat feed on the internet.

275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.

Look up an IOC → · Audit your brand on AIPM → · See pricing →

---

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=when-100b-in-market-cap-reads-your-free-feed