Browse public community intelligence reports, source analysis, and threat research.
23 intel reports
Storm-2755 (Payroll Pirates) uses AiTM phishing and Microsoft Graph reconnaissance to hijack Microsoft 365 sessions and divert employee salaries.
Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.
Gunra (also known as Golden Community) is a RaaS operation using a double-extortion model targeting critical infrastructure by exploiting vulnerabilities in Fortinet appliances and leveraging Impacket for lateral movement.
UNC6671 and associated clusters utilize sophisticated vishing and AiTM panels to harvest credentials and exfiltrate data from enterprise cloud and financial platforms.
Researchers identified a method for malware to abuse Windows Hello for Business keys to authenticate to Entra ID and register rogue devices for long-term persistence.
Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.
Attackers are abusing the OAuth 2.0 device authorization grant to trick users into authenticating malicious sessions on legitimate Microsoft sign-in pages, bypassing MFA.
The threat actor ShinyHunters and affiliated clusters are targeting SaaS platforms, specifically Salesforce, using vishing and OAuth integration abuse for data exfiltration and extortion.
The Helix data extortion group uses social engineering and device code phishing to hijack Microsoft 365 accounts and exfiltrate sensitive SharePoint data.
The O-UNC-066 threat actor is targeting Microsoft 365 users through vishing and real-time phishing panels to hijack Entra passkey enrollment for data extortion.
