No (Bad) CAP: Inside an Ongoing LSHIY Password Spray Attack
Acknowledgments: Special thanks to Dave Kleinatland, Matt Kiely, Jamin Becker, Bryan Masters, Justin Allen, and Arnelle French for their contributions to this investigation. UPDATE @…
Category: ThreatIntelligence-IncidentResponse
How the RaaS Business Model Actually Works
When most people hear the word “disruption,” they think about business growth, new markets, or a competitor making a bold move. Ransomware crews have their…
Celebrating Canada Day with Localized Managed Phishing
We hope all of our Canadian readers had a happy Canada Day! As you settle back in from what was hopefully a relaxing day off,…
Meta Phishers Abuse Business Account Manager Service
Beginning late last year, an unknown threat actor took advantage of a service offered by Meta meant to connect businesses who use Facebook or Instagram…
LoTL Abuse: How to Spot It vs. Normal Admin Activity
At 5:47 p.m. on a Friday, someone runs PowerShell in your environment. Maybe it’s a tired admin finishing one last task before signing off. But…
AI-Coded Malware | Analyzing Vibe-Coded AD Enumeration
AI-augmented tradecraft is changing the threat landscape that defenders have operated in. For years, defenders have relied on identifying the signatures and behaviors of off-the-shelf…
How to Meet CISA BOD 26-04’s 3-Day Remediation SLA
Key Takeaways CISA BOD 26–04 mandates remediation of the publicly exposed, highest-risk, known-exploited vulnerabilities within 3 days. The directive applies a risk-based model evaluating exposure,…
Conditional Access Misconfigurations Exposed 55 Orgs with MFA On
In March 2026, our SOC caught a surge of anomalous Microsoft 365 logins across dozens of organizations simultaneously. The source: a handful of IP addresses…
When AI-Accelerated Discovery Outruns Patching, Exploitability Proof Decides What Gets Fixed First
Why Qualys joined the Athena coalition, and what it means for how you prioritize risk. Qualys is proud to have joined Athena, the industry coalition…
OWASP Top 10 2025 Coverage Map: Is Your AppSec Program Ready?
Key Takeaways Most AppSec programs treat API-layer coverage as a DAST extension, but BOLA, BFLA, and SSRF require authenticated multi-role testing that traditional scanners weren’t…
Microsoft 365 Hardening and Huntress Managed ISPM
We spent three months assessing how Microsoft 365 environments actually get compromised. What we found should change how you think about identity hardening. In front…
Train, triage, repeat: The AI agent changing how we fight phishing
We’ve already established that artificial intelligence is raising the bar for adversaries. This is especially the case when it comes to crafting phishing messages. These…