Enterprise Threat Intel

Medusa has impacted over 500 organizations across critical infrastructure since 2021, shifting to an affiliate RaaS model in early 2023.

• Affiliates...

• Ransom Busters emails victims claiming to have breached RaaS servers and offers to delete stolen data for $20,000–$60,000
• Shared tools, backdoors,...

Ransomware affiliates and China-linked APTs are integrating AI into live operations for speed, while keeping core development human-driven.

-...

Medusa ransomware has added hundreds of victims since March 2025 by paying access brokers $100 to $1 million, with premiums for exclusive work.

-...

• IT cloud LOTL: TwinLoot runs full C2 via SharePoint, Graph API, and Teams TURN relays, blending into legitimate Microsoft traffic.
• OT native...

Regional APTs are pivoting from mass phishing to stealthy campaigns focused on diplomatic, military, and critical infrastructure targets across...

Ransomware gangs are actively exploiting a high-severity Windows Task Host vulnerability, CISA confirms. SOC and IR teams should treat this as patch priority given the confirmed active exploitation since at least April.

Clop operators built a custom Java web shell specifically for PTC Windchill and FlexPLM servers, with built-in capabilities to decrypt credentials, enumerate file repositories, and steal targeted data.

A ransomware affiliate is emailing victims directly, claiming to have breached RaaS groups and offering file recovery plus data deletion for...

• Adversary AI use surges: 89% rise in AI-enabled threats, including LLMJacking and fake AI companies by DPRK actors
• Defensive AI integration:...

Medusa ransomware operators have struck more than 500 victims as of April 2026, up from 300 the prior year, with heavy focus on healthcare.

Key...

• Ransomware operators used Claude to rank production databases and stage SQL dumps for exfil
• Zerofot built credential scanners with Codex to...

Akira operators now force Windows systems into Safe Mode after direct AV interference often fails and triggers quarantines.

• They modify boot...

• Cl0p named Shell, Philips, GE among ~50 victims after exploiting CVE-2026-12569 in PTC Windchill/FlexPLM for RCE and data theft
• Campaign launched...

The Iran-linked campaign against U.S. drinking water and wastewater systems has grown from seven to at least twelve states, with the first documented...

This week's activity shows attackers exploiting exposed services and unpatched flaws for initial access, then pivoting quickly.

• VMware vCenter...

Chinese APT groups are expanding beyond traditional espionage into AI-augmented lures, rapid VMware exploitation, and kernel-level stealth.

-...

This integration feeds Nozomi OT telemetry and asset data directly into Sophos Fusion.

• Single-pane correlation: SOC teams combine industrial threats...

S2W's H1 2026 report recorded 158 state-sponsored incidents from North Korea, Russia, and China — a 7.5% rise from 147 the prior period.

China's...

North Korea conducted 99 AI and deepfake attacks targeting South Korea in the first half of 2026, per the '2026 First Half Threat Trends Report on...