Enterprise Threat Intel

SonicWall claims a 242% YoY surge in state/local IPS hits exceeding 300 million in H1 2026, driven by legacy portals and unpatched systems. This...

Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) are actively exploiting CVE-2026-0257 for unauthorized GlobalProtect VPN access, bypassing...

• Dynamic Permissions grant agents zero or minimal access upfront, issuing per-task rights that auto-expire while routing high-impact actions to human...

Lazarus Group (APT38/Hidden Cobra) is actively targeting cryptocurrency exchanges, defense, aerospace, and media via spearphishing, edge exploitation,...

• Victim verified: Pengurusan Aset Air Berhad (www.paab.my), Energy & Utilities sector, Malaysia
• Breach dated 2026-10-18 with no reported details on...

SOCRadar's dual-layered API suite removes the old trade-off between raw flexibility and ready-made scale for MSSPs.

• Workflow impact: The...

A cyberattack on outdated French supermarket refrigeration systems caused massive spoilage and highlights how legacy operational technology can be...

Sandworm Team (high confidence, GRU 74455 / UAC-0113) is running an active destructive campaign with 240+ victims.

• Targets: Ukrainian...

GTIG attributes the late-August 2026 zero-day exploitation of BeyondTrust Remote Support (CVE-2026-102764) to ARMORY CASTLE (ex-UNC5221), a suspected...

• No encryption does not rule out Clop: Since 2021 the group has driven mass extortion solely through zero-day theft from file-transfer and business...

Silent Lynx targets government bodies across Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus,...

TLCTC supplies the missing causal structure inside the Diamond Model's Capability vertex, turning vague tool lists into explicit vulnerability-based...

Traditional IOC blocking is failing as 79% of intrusions now use no malware and mimic normal activity.

Defenders can pivot to TTPs for behavior-based...

Ransomware extortion has escalated from data encryption and leaks to direct threats of physical harm against employees, executives, and their...

Unknown internet-facing assets represent an inventory failure that leaves organizations blind to their true attack surface. Treat every alert as live...

Ransomware isn't just encrypted servers—it's nurses losing safety tools and patients waiting for results that never come. Hospitals become high-value...

MuddyWater deliberately posed as the Chaos ransomware group during early 2026 Microsoft Teams intrusions involving credential theft and MFA...

Secure.com argues ransomware budgets should target stolen credentials, unpatched internet-facing systems, and phishing first—before AI tools—since...

Ransomware groups now layer physical and psychological threats against executives and employees on top of data encryption and leaks, forcing...

50% of organizations expect threat intelligence budget growth as AI threats and security operations challenges create opportunities for MSSPs....