Browse public community intelligence reports, source analysis, and threat research.
3 intel reports
Attackers give the open source ARTEX framework credentials and a goal. Its AI agents then run Active Directory enumeration, Kerberoasting, DCSync and cloud probing. Google tracks the activity as UNC7228, which overlaps Storm-0940.
Adversaries utilize various AWS-native features including IAM users, cross-account roles, Lambda backdoors, and federated sessions to maintain long-term persistence in victim cloud environments.
Threat actors are exploiting CVE-2026-48558 in SimpleHelp RMM software to deploy TaskWeaver and Djinn Stealer, targeting cloud, AI, and developer credentials across Windows, macOS, and Linux.
