Intel Exchange

CopperDragon acts as a digital quartermaster for China-nexus actors, deploying the Sparrow framework via watering-hole attacks and internet-facing exploits against telecom and government sectors.

BlackSuit ransomware operators conducted a 15-day intrusion involving Kerberoasting, lateral movement via SMB and RDP, and persistence through SystemBC before final encryption.

CopperDragon acts as a digital quartermaster for China-nexus actors, deploying the Sparrow framework via watering-hole attacks and internet-facing exploits against telecom and government sectors.

DoNot APT (APT-C-35) utilized Go-based reverse shells and Inveigh credential harvesting tools targeting Pakistan's nuclear and energy sectors.

A 3AM ransomware affiliate targeted a UK school estate using a hybrid operation where a human operator guided an agentic AI loop to execute repetitive lateral movement and domain trust configuration tasks.

Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.

SafePay ransomware actors target global critical infrastructure by exploiting edge device vulnerabilities and using legitimate administrative tools for data exfiltration and hybrid encryption.

Ransomware actors Spikey Scorpius and Tarnished Scorpius are exploiting an authentication bypass in PAN-OS GlobalProtect (CVE-2026-0257) to gain initial access, bypass MFA, and pivot to virtualization infrastructure.

Ransomware actors including Spikey Scorpius and Tarnished Scorpius are exploiting CVE-2026-0257 to bypass MFA and gain initial access to corporate networks via PAN-OS VPNs.

Qilin (aka Agenda) is a high-volume Russian-speaking RaaS operation targeting global manufacturing and healthcare sectors through credential abuse and advanced EDR evasion.