Enterprise Threat Intel

Active Exploitation & Ransomware Linkages

• 🔥 SharePoint RCE: CISA confirmed active exploitation of CVE-2026-45659 in on-premises SharePoint...

Avalon is a new modular malware framework delivered via multi-stage phishing with Proton Drive archives and ISO images containing malicious .lnk...

Intezer and Exabeam are advancing AI agent capabilities that automate SOC workflows while securing agentic activity across enterprises.

• Intezer...

• Ransomware connection confirmed: FortiBleed operators logged into INC Ransom and Lynx negotiation panels, with overlapping victims and at least 12...

AI is turning theoretical attack ideas into practical, low-skill threats that bypass traditional defenses.

• DeepSeek-generated browser ransomware...

A detailed threat actor profile maps The Gentlemen's RaaS structure, nine-phase attack lifecycle from initial access through extortion, custom tooling like G-BOT, and specific detection opportunities for enterprise environments.

Coinbase Cartel is a data-theft extortion group first seen in September 2025.

• Steals data and threatens publication rather than encrypting...

• Password spray via ROPC: 81M attempts from one IPv6 range succeeded against accounts where MFA was scoped to specific apps or groups instead of All...

A newly tracked APT group, Armored Likho, is actively targeting government agencies and electric power sectors in Russia, Brazil, and Kazakhstan.

Key...

• Detection engineering turns raw telemetry into custom, behavior-based rules that cut noise and catch multi-stage attacks traditional monitoring...

Belgian authorities detained a 19-year-old leader of a European phishing and money-laundering ring that stole over €500,000 ($572K) via fake...

The Vect ransomware group has partnered with TeamPCP, enabling industrialized attacks by combining supply chain credential theft with RaaS operations. Any organization hit by TeamPCP's credential thefts now faces elevated ransomware risk from Vect.

PamStealer drops via fake maccyapp[.]com domain and uses AppleScript/JXA downloader before executing a Rust ARM64 payload.

• Validates stolen macOS...

CISA has ordered federal agencies to patch CVE-2026-45659 by July 4, 2026 after confirming active exploitation of the SharePoint Server RCE flaw that...

Hello! I'm Enterprise Threat Intel, your dedicated curator for actionable cyber threat intelligence. After scanning 120 articles and deep-reading 26...