Enterprise Threat Intel

The Gentlemen ransomware stands out for its aggressive self-propagation, attempting up to 21 remote execution techniques per host via the --spread...

Ransomware Reports and Campaigns

• 🔥 NCSC Ransomware Statistics: Data from Report Fraud reveals that 323 organisations reported a ransomware...

• 323 organisations reported ransomware attacks April 2025–March 2026, with 175 (over 50%) from SMEs.
• Reported losses reached £270,000, up 50%...

• Pure data extortion: Kairos stole 2TB of files from Union County, Ohio without deploying any ransomware or encryption
• Payment without proof: The...

Europol dismantled AudiA6, an industrial-scale cryptocurrency mixing service that laundered EUR 336 million for ransomware operators and other...

• Source evaluation applies NATO admiralty grading to every feed and report, producing defensible confidence scores.
• Diamond Model and ATT&CK...

Anubis exploits CVE-2025-5777 via crafted HTTP POST requests to extract ~127 bytes of uninitialized memory containing active session tokens.

• MFA...

Active Exploitation & Ransomware Linkages

• 🔥 SharePoint RCE: CISA confirmed active exploitation of CVE-2026-45659 in on-premises SharePoint...

Avalon is a new modular malware framework delivered via multi-stage phishing with Proton Drive archives and ISO images containing malicious .lnk...

Intezer and Exabeam are advancing AI agent capabilities that automate SOC workflows while securing agentic activity across enterprises.

• Intezer...

• Ransomware connection confirmed: FortiBleed operators logged into INC Ransom and Lynx negotiation panels, with overlapping victims and at least 12...

AI is turning theoretical attack ideas into practical, low-skill threats that bypass traditional defenses.

• DeepSeek-generated browser ransomware...

A detailed threat actor profile maps The Gentlemen's RaaS structure, nine-phase attack lifecycle from initial access through extortion, custom tooling like G-BOT, and specific detection opportunities for enterprise environments.

Coinbase Cartel is a data-theft extortion group first seen in September 2025.

• Steals data and threatens publication rather than encrypting...

• Password spray via ROPC: 81M attempts from one IPv6 range succeeded against accounts where MFA was scoped to specific apps or groups instead of All...

A newly tracked APT group, Armored Likho, is actively targeting government agencies and electric power sectors in Russia, Brazil, and Kazakhstan.

Key...

• Detection engineering turns raw telemetry into custom, behavior-based rules that cut noise and catch multi-stage attacks traditional monitoring...

Belgian authorities detained a 19-year-old leader of a European phishing and money-laundering ring that stole over €500,000 ($572K) via fake...

The Vect ransomware group has partnered with TeamPCP, enabling industrialized attacks by combining supply chain credential theft with RaaS operations. Any organization hit by TeamPCP's credential thefts now faces elevated ransomware risk from Vect.

PamStealer drops via fake maccyapp[.]com domain and uses AppleScript/JXA downloader before executing a Rust ARM64 payload.

• Validates stolen macOS...