Aggregated view of active CVEs, ransomware activity, phishing campaigns, threat-actor TTPs, and automated blocklist updates.
Automated correlation across multiple feeds identified 5,056 new C2, phishing, and malware-distribution domains. Auto-pushed to DNS sinkhole policy.
Automated correlation across multiple feeds identified 5,057 new C2, phishing, and malware-distribution domains. Auto-pushed to DNS sinkhole policy.
New phishing wave impersonating DHL sign-in pages. Lure: "shared document" or "expiring access". Landing pages rotate across .top / .xyz / .click TLDs with reverse-proxy MFA bypass.
New phishing wave impersonating Banco Santander sign-in pages. Lure: "shared document" or "expiring access". Landing pages rotate across .top / .xyz / .click TLDs with reverse-proxy MFA bypass.
New phishing wave impersonating Microsoft 365 sign-in pages. Lure: "shared document" or "expiring access". Landing pages rotate across .top / .xyz / .click TLDs with reverse-proxy MFA bypass.
New phishing wave impersonating Google Workspace sign-in pages. Lure: "shared document" or "expiring access". Landing pages rotate across .top / .xyz / .click TLDs with reverse-proxy MFA bypass.
A sql injection affecting SAP S/4HANA is being actively exploited in the wild. Vendor has released a hotfix; patch within 48 hours for internet-facing assets.
A sql injection affecting Adobe Acrobat Reader is being actively exploited in the wild. Vendor has released a hotfix; patch within 48 hours for internet-facing assets.
A sql injection affecting Apache Struts is being actively exploited in the wild. Vendor has released a hotfix; patch within 48 hours for internet-facing assets.
A sql injection affecting Palo Alto GlobalProtect is being actively exploited in the wild. Vendor has released a hotfix; patch within 48 hours for internet-facing assets.
A sql injection affecting Microsoft Active Directory is being actively exploited in the wild. Vendor has released a hotfix; patch within 48 hours for internet-facing assets.
Royal leak site listed 2 new victims this week, primarily in the undefined sector. Initial access via vulnerable internet-facing edge devices.
BianLian leak site listed 3 new victims this week, primarily in the undefined sector. Initial access via vulnerable internet-facing edge devices.
Medusa leak site listed 4 new victims this week, primarily in the undefined sector. Initial access via vulnerable internet-facing edge devices.
8Base leak site listed 5 new victims this week, primarily in the undefined sector. Initial access via vulnerable internet-facing edge devices.
Increased spearphishing operators attributed to APT29 (Cozy Bear) over the past 7 days. Targeting: defense contractors, NGOs, and government bodies. New custom loader observed.
Increased spearphishing operators attributed to Lazarus Group over the past 7 days. Targeting: defense contractors, NGOs, and government bodies. New custom loader observed.
Increased spearphishing operators attributed to FIN7 over the past 7 days. Targeting: defense contractors, NGOs, and government bodies. New custom loader observed.
Click any intel card to see full briefing.