Update README.md

README.md

@@ -8,10 +8,22 @@ A collection of papers, blogs, and resources that make up the quintessential asp
 | [iSIGHT Partners](https://www.linkedin.com/company/isight-partners) | The first definitive guide to cyber threat intelligence ever produced | [cti-guide.pdf](https://cryptome.org/2015/09/cti-guide.pdf) |
 | [David J. Bianco](https://twitter.com/DavidJBianco) | Analysing relationships between the types of indicators you might use to detect an adversary's activities and how much pain it will cause them when you are able to deny those indicators to them | [the-pyramid-of-pain.html](https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html) |
 | [Lockheed Martin](https://en.wikipedia.org/wiki/Lockheed_Martin) | The Cyber Kill Chain® framework is part of the Intelligence Driven Defense® model for the identification and prevention of cyber intrusions activity. The model identifies what the adversaries must complete in order to achieve their objective | [Cyber_Kill_Chain.pdf](https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/Gaining_the_Advantage_Cyber_Kill_Chain.pdf) |
-| [RAND Corporation](https://en.wikipedia.org/wiki/RAND_Corporation) | This report describes the fundamental characteristics of cybercriminal black markets and how they have grown into their current state in order to give insight into how their existence can harm the information security environment | [RAND_RR610.pdf](https://www.rand.org/content/dam/rand/pubs/research_reports/RR600/RR610/RAND_RR610.pdf) |
 | [Mercyhurst University Institute for Intelligence Studies](https://en.wikipedia.org/wiki/Mercyhurst_University_Institute_for_Intelligence_Studies) | The Analyst’s Style Manual is a product intended to assist student analysts with the many perplexing and complex rules they should follow in producing written intelligence products | [analysts_style_manual.pdf](https://ncirc.bja.ojp.gov/sites/g/files/xyckuh326/files/media/document/analysts_style_manual.pdf) |
 | [Freddy M](https://no.linkedin.com/in/fmurre?trk=pulse-article_main-author-card) | The Intelligence Architecture Map is based on interviews of industry experts, former intelligence practitioners, and Freddy's personal views. It represents a logical and meaningful way of how different aspects of producing intelligence should be put together. | [intelligence-architecture-map-freddy-m](https://www.linkedin.com/pulse/intelligence-architecture-map-freddy-m/) |
-| [@Bank_Security](https://twitter.com/Bank_Security) | HUMINT activities during undercover operations are fundamental as a part of Cyber Intelligence activities. This guide shares insights how someone could engage Threat Actors during undercover operations in the cybercriminal underground | [cyber-intelligence-humint-operations](https://bank-security.medium.com/cyber-intelligence-humint-operations-2d3d526e4007) |
+
+### `Adversary Intelligence`
 | [Mandiant](https://www.mandiant.com/) | Mandiant's unprecedented report linking APT1 to China's 2nd Bureau of the People's Liberation Army (PLA) General Staff Department's (GSD) 3rd Department (Military Cover Designator 61398). | [mandiant-apt1-report.pdf](https://www.mandiant.com/resources/apt1-exposing-one-of-chinas-cyber-espionage-units)|
 | [Katie Nickels](https://twitter.com/likethecoins)| Analysts have compiled a list of court documents issued by the Department of Justice (DOJ) specifically regarding various threat actor charges and indictments, from APT group members to ransomware operators | [Legal Documents of Interest to CTI Analysts](https://docs.google.com/spreadsheets/d/12iZfDkc-DtVNXV5ZoOiKKZuNGcsb3yQ0V3DNBQIalSo/htmlview#gid=1677585875) |
+
+### `The Cyber Underground`
+
+| Authour | Description | Resource URL |
+| --- | --- | --- |
+| [RAND Corporation](https://en.wikipedia.org/wiki/RAND_Corporation) | This report describes the fundamental characteristics of cybercriminal black markets and how they have grown into their current state in order to give insight into how their existence can harm the information security environment | [RAND_RR610.pdf](https://www.rand.org/content/dam/rand/pubs/research_reports/RR600/RR610/RAND_RR610.pdf) |
+| [@Bank_Security](https://twitter.com/Bank_Security) | HUMINT activities during undercover operations are fundamental as a part of Cyber Intelligence activities. This guide shares insights how someone could engage Threat Actors during undercover operations in the cybercriminal underground | [cyber-intelligence-humint-operations](https://bank-security.medium.com/cyber-intelligence-humint-operations-2d3d526e4007) |
+
+### `Vulnerability Intelligence`
+
+| Authour | Description | Resource URL |
+| --- | --- | --- |
 | [Google Project Zero](https://twitter.com/ProjectZeroBugs) | GP0 has compiled a spreadsheet of 0day vulnerabilities leveraged in the wild by threat actors before the vendors were aware of them | [0days "In the Wild"](https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/view)|