Intel Exchange

The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.

Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.

The suspected PRC-nexus actor ARMORY CASTLE exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to deploy custom SAWFLY webshells and BARECLAW tunnelers for credential theft and lateral movement.

An unknown actor used a compromised ConnectWise Cloud Backup (SkyKick) application credential to sign in to customer Microsoft 365 tenants as the application itself, with Huntress reporting successful sign-ins in over 300 tenants.

The TRUST#GRAFT campaign utilizes a browser-mediated JavaScript loader to hijack authenticated WordPress administrator sessions for the deployment of a persistent PHP backdoor.

Threat actors are using stolen UpdraftCentral connection keys to deploy malicious plugins and create administrator accounts on WordPress websites.

Cluster CL-STA-0954 (UNC5820) exploited multiple Fortinet vulnerabilities, including CVE-2024-47575 and CVE-2025-61624, to deploy a novel memory-resident ARM64 implant named PEERSTITCH against telecommunications providers.

Threat actors Storm-3121 and Storm-3032 utilize passkey-themed social engineering and AiTM phishing to compromise Microsoft cloud identities for automated data exfiltration via Microsoft Graph.

Akira ransomware targets global organizations across Windows and Linux platforms using double extortion, vulnerability exploitation, and credential theft.

Play (or Playcrypt) is a sophisticated ransomware group utilizing double extortion, custom information stealers like Grixba, and exploitation of vulnerabilities in FortiOS and Microsoft Exchange to target global organizations.