Sign in Subscribe

Threat Intelligence

Threat briefs on specific campaigns and adversary groups. Each includes technical attack chain analysis, attribution, and a 30/60/90-day outlook. Structured so the executive summary works for leadership and the technical sections work for the team running detection.

ConsentFix: MFA-Bypassing OAuth Phishing

Threat Intelligence

ConsentFix: MFA-Bypassing OAuth Phishing

ConsentFix lets attackers hijack Microsoft's own OAuth sign-in flow to steal authorization codes and bypass MFA entirely. Researchers link the technique with moderate-to-high confidence to Russia's APT29.

GRU Tradecraft and Network Edge Access

Threat Intelligence

GRU Tradecraft and Network Edge Access

A GRU-aligned team is abusing misconfigured, cloud-hosted network edge devices as passive listening posts, harvesting and replaying credentials into Western energy, logistics, and telecom networks without deploying any malware.

China’s Typhoon Tradecraft and Risk

Threat Intelligence

China’s Typhoon Tradecraft and Risk

China's Typhoon ecosystem spans distinct PRC clusters — Volt for infrastructure pre-positioning, Salt for telecom surveillance, Silk for supply-chain pivoting — all sharing a playbook of credential abuse and living-off-the-land persistence on unpatched edge devices.

eBPF-Based Rootkits

Threat Intelligence

eBPF-Based Rootkits

eBPF-based rootkits BPFDoor and Symbiote hide backdoor logic inside the Linux kernel's packet-filtering layer, giving state-linked operators years of undetected access to telecom and financial infrastructure with no open ports or visible processes.

Ransomware Groups Targeting Maritime and Marine-Industrial Organizations

Threat Intelligence

Ransomware Groups Targeting Maritime and Marine-Industrial Organizations

Nova, Akira, and Qilin are deliberately targeting maritime service and engineering firms for port-call packets, vessel schedules, and turbine maintenance records, turning a single contractor breach into leverage across entire shipping and port ecosystems.

Pre-Built Toolkits Are Simplifying Cybercrime

Threat Intelligence

Pre-Built Toolkits Are Simplifying Cybercrime

Commercial kits like Tycoon 2FA and SessionShark now let low-skill attackers bypass MFA and blind EDR without writing custom malware, fueling a surge in account takeovers, BEC, and ransomware access.

Qilin Ransomware Threat

Threat Intelligence

Qilin Ransomware Threat

Qilin affiliates run Linux encryptors on Windows through legitimate RMM tools, pair BYOVD attacks with Veeam credential theft, and have hit manufacturers like Nissan and Asahi Group Holdings for tens of millions in losses.

Threat Intelligence

The Security Risks & Governance of AI-Driven Browsers

AI browsers like Perplexity Comet, OpenAI Atlas, and Fellou can be hijacked through hidden prompts in ordinary web content, letting attackers steal data or delete files with no malware and no alerts.