Browse public community intelligence reports, source analysis, and threat research.
23 intel reports
The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.
Scattered Spider and related affiliates use vishing to trick employees into enrolling adversary-controlled passkeys, enabling mass data exfiltration from Microsoft 365 environments.
Threat actors Storm-3121 and Storm-3032 utilize passkey-themed social engineering and AiTM phishing to compromise Microsoft cloud identities for automated data exfiltration via Microsoft Graph.
Helix extortion group uses vishing and device code phishing to compromise identities and automate bulk data exfiltration from SharePoint environments.
Threat actors are increasingly using AI-powered Phishing-as-a-Service (PhaaS) kits like the Jalisco toolkit to bypass MFA via device code phishing and OAuth token harvesting.
Russian-speaking threat actor Azazel, an affiliate of the Gentlemen ransomware group, utilizes stolen CI/CD secrets and novel MCP-based C2 channels to target global sectors and host stolen data on an independent leak site, LEAKNED.
ExfilSquad is a data extortion group targeting organizations by exploiting misconfigured Microsoft Power Pages portals to exfiltrate Dataverse records via public APIs.
DPRK-nexus actors are using fake Web3 job interviews to deliver signed ClickOnce applications that deploy NeedleStealer, an unclassified Rust stealer, and a Go-based hVNC RAT.
Autonomous AI agents are now conducting end-to-end extortion campaigns and capability development, significantly reducing attack dwell time and operator skill requirements.
PREY-0058 (UNC6671) uses help-desk vishing and AiTM phishing to steal Microsoft 365 session tokens for bulk data exfiltration from SharePoint and Exchange via residential proxies.
