Intel Feed
Cyber Threat IntelligencePage 5
Reports
Reporting archive — page 5
Showing 97–120 of 611 reports
MacSync Shows Why macOS Stealers Need Full Endpoint Response
Kaspersky’s MacSync research shows why SMB and government-contractor defenders should treat macOS infostealers as full intrusion risk, not simple nuisance malware.
NetScaler KEV RCEs Show Why Edge Devices Need Emergency Playbooks
Citrix and CISA confirmed active exploitation of two critical NetScaler ADC/Gateway flaws. Here is how SMB and government-contractor defenders should patch, verify exposure, and hunt for compromise.
PeopleSoft WAF Bypass Shows Why Patch-First Beats Perimeter Rules
GTIG/Mandiant report renewed PeopleSoft exploitation using encoded-path WAF bypasses. Here is what defenders should validate beyond perimeter string matching.
Storm-3168 Shows Why Service Principals Are Cloud Ransomware Risk
Microsoft’s Storm-3168 reporting shows how compromised Azure service principals can drive fast cloud destruction, credential collection, and recovery sabotage. Here is what SMB and government-contractor defenders should tighten first.
Lunex Stealer Shows BYOVD Is Moving Into Credential Theft
Lunex/Psychedelic Stealer uses BYOVD tradecraft to blind endpoint security before stealing browser credentials, cookies, and wallet data. Here is what SMB and government-contractor defenders should prioritize.
Storm-2570 Shows Why Ransomware Defense Should Track Tradecraft, Not Payloads
Microsoft’s Storm-2570 reporting shows why defenders should track ransomware affiliate behavior: RMM abuse, tunnels, credential theft, lateral movement, security tampering, and cloud exfiltration before encryption.
UTA0565 Shows Why Browser Zero-Days Need Endpoint Correlation
Volexity reporting on UTA0565 shows how fake websites, Chrome zero-days, Windows privilege escalation, and CLEANGULP malware turn normal browsing into endpoint compromise. Here are practical controls for SMBs and government contractors.
ClickFix Shows Why Brand Impersonation Needs Workflow-Based Defense
Recorded Future’s ClickFix research shows how trusted logos and verification prompts can turn users into the delivery mechanism. Here is how SMBs and government contractors should defend the workflow, not just the payload.
Malicious Terraform Providers Show Why IaC Needs Supply-Chain Controls
Aikido found Graphalgo-linked Go malware in Terraform providers and Go modules. The defensive lesson is that infrastructure-as-code dependencies need the same scrutiny as application packages, because they often execute near production credentials.
RemControl Shows Why Mobile Banking Fraud Needs App-Control Guardrails
Group-IB reported RemControl, a new Android banking trojan that combines fake app pages, Accessibility Service abuse, banking overlays, remote control, and AI-assisted criminal infrastructure. The defensive lesson: mobile devices that approve access or payments need app-control guardrails and incident playbooks.
EvilTokens Shows Why Device Code Phishing Needs Identity Controls
Microsoft says EvilTokens helped compromise more than 12,000 inboxes by abusing device code authentication. Here is what SMBs and government contractors should lock down now.
TeamFiltration Shows Why Forgotten Service Accounts Are Cloud Identity Risk
Proofpoint tracked a TeamFiltration-style Microsoft 365 password-spraying campaign where every confirmed compromise involved unmanaged service accounts. The defensive lesson: non-human identities need ownership, rotation, conditional access, and behavior monitoring.
CLOSEDQUORUM Shows Why AI C2 Needs Behavior-Based Detection
Cisco Talos documented CLOSEDQUORUM, an AI-assisted implant that uses multiple LLM providers to choose its next action. The defensive answer is correlation, not simple domain blocking.
M-26-15 Makes PQC Migration a Contractor Readiness Issue
OMB Memorandum M-26-15 turns post-quantum cryptography migration into a planning, inventory, procurement, and contractor-readiness problem. Federal agencies and vendors should start with cryptographic inventories, TLS 1.3 milestones, crypto-agile architecture, and contract language now.
Exposed AWS Keys Show Why Secret Scanning Needs Incident Runbooks
Unit 42 analyzed how AWS quarantines publicly exposed IAM access keys after GitHub secret-scanning detections. For SMBs and government contractors, the lesson is clear: provider automation helps, but cloud teams still need logging, rotation, and incident runbooks for leaked secrets.
PAYLOAD Ransomware Shows Why Group Policy Is a Tier-0 Attack Surface
Kaspersky reported a PAYLOAD ransomware incident where attackers abused Active Directory Group Policy to disrupt domain-joined Windows systems without deploying a Windows encryptor. The lesson for SMBs and government contractors: Group Policy needs Tier-0 monitoring, change control, and recovery planning.
Orkes Conductor RCE Shows Why Workflow APIs Need Hard Network Boundaries
Attackers are actively targeting Orkes Conductor deployments vulnerable to CVE-2026-58138, an unauthenticated remote code execution flaw in workflow script evaluators. The practical lesson: workflow APIs and automation control planes need patching, segmentation, and tight exposure control.
Linux Kernel LPE Quartet Shows Why Patch Validation Matters
Four Linux kernel local-root vulnerabilities show why defenders need kernel patch validation, container-host prioritization, and attack-surface reduction—not just initial-access monitoring.
Gyazo Breach Shows Why Screenshot Tools Need Data-Loss Controls
Gyazo disclosed unauthorized access affecting 23.62 million user records and roughly 490 million image metadata records. The lesson for SMBs and government contractors is simple: screenshot and screen-recording tools are data stores, not harmless utilities.
Fake GitHub Repos Show Why Software Downloads Need Trust Verification
A Rapuncel infostealer campaign abused fake GitHub software repositories, oversized archives, DLL sideloading, and a signed kernel driver to suppress defenses and steal credentials.
WaterPlum Shows Why Developer Hiring Needs Malware-Resistant Guardrails
North Korea-linked WaterPlum/Contagious Interview shows why developer hiring, coding tests, contractor onboarding, and workstation isolation need to be treated as one security workflow.
BragJack Shows Why AI Browser Agents Need Extension Controls
BragJack demonstrates how malicious extensions can hijack AI browser agents, turning browser add-ons into a higher-impact endpoint risk. Here are the practical controls SMBs and government contractors should prioritize.
Honeywell Settlement Shows NIST 800-171 Is a Billing Risk
DOJ’s Honeywell Aerospace settlement is a reminder that NIST 800-171 gaps can create False Claims Act exposure for defense contractors even without a public breach.
Passkey Phishing Shows Why Microsoft 365 Needs Enrollment Guardrails
Microsoft is tracking passkey-themed social engineering that turns MFA enrollment trust into Microsoft 365 cloud compromise. Here is what SMBs and government contractors should monitor and lock down.