Tim Peck

Threat actors can abuse Windows Quality of Service (QoS) policies via PowerShell or WMI to throttle EDR agent outbound bandwidth to near zero, effectively silencing cloud-based telemetry.

Attacker sergey2016 compromised the @mastra npm organization to inject the easy-day-js typosquat dependency, delivering an obfuscated postinstall dropper.

Attackers leverage the Windows Distributed Component Object Model (DCOM) to execute remote commands via trusted binaries like mmc.exe and excel.exe.

The GLASSWORM threat actor is deploying trojanized Open VSX extensions using TinyGo-compiled WebAssembly loaders that leverage Solana blockchain memos for C2 infrastructure resolution.

An attacker compromised the CDN API keys of OptinMonster, TrustPulse, and PushEngage to serve tampered JavaScript that creates rogue admin accounts on customer sites.

EtherRAT uses the Ethereum blockchain for resilient C2 infrastructure while distributing via malicious MSI and PowerShell loaders.

Authenticated attackers can exploit a path traversal vulnerability in SharePoint's Upload.aspx to upload ASPX webshells and achieve remote code execution.

Threat actors including BlackCat and STORM-0501 are leveraging native Azure features like Encryption Scopes and Customer-Provided Keys to encrypt and hold blob storage for ransom.

Team PCP's Miasma toolkit automates software supply chain attacks by poisoning package registries, hijacking GitHub Actions, and injecting malicious configurations into AI coding agents.

The Miasma campaign targets @redhat-cloud-services npm packages using a multi-stage loader and Bun-executed credential stealer to exfiltrate secrets via GitHub APIs.