New BitLocker extortion activity: RDP, MSSQL, RMM Abuse
Recently, our teams in Latin America investigated a series of incidents involving misconfiguration, the deployment of BitLocker, and the exploitation of corporate printers. Attackers used…
Category: VendorResearch
Threat Hunting: A Guide | Recorded Future
Enterprise security architectures have never been more heavily funded, yet the perimeter is functionally obsolete. Despite multi-million dollar investments in next-generation firewalls and complex defense…
OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials
At least two distinct threat actors are weaponizing a novel evasion technique called OAuth client ID spoofing in cloud campaigns, while slipping past telemetry. The…
Inside Qilin Ransomware: Custom Rust Loader and Kernel-Level EDR Killer
Qilin ransomware is a highly active and sophisticated ransomware operation that has rapidly modernized its evasion techniques. Historically focused on file encryption, the ransomware-as-a-service (RaaS)…
Microsoft at Black Hat USA 2026: Defending trust in the age of AI and supply chain attacks
In this article Across the threat landscape, in this moment, one pattern sits at the center of the story: threat actors are following trust. They…
Tracking Advanced Persistent Threat Groups
Key takeaways Advanced Persistent Threats (APTs) are sophisticated, long-term cyber campaigns conducted by well-funded human adversaries (often nation-states) who target specific organizations for espionage, data…
Least privilege for AI agents: Identity, access, and tool binding
In this article AI agents aren’t only smarter API callers. They plan, chain actions across systems, and invoke tools in sequences while no single human…
AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report
Unit 42’s 2026 Global Incident Response Report offers frontline intelligence drawn directly from global investigations. The report spotlights four defining trends shaping the threat landscape.…
The Shift: A New Era of AI Regulation
The export controls imposed on Anthropic’s Fable model mark a significant shift in United States (US) artificial intelligence (AI) policy. The controls set a precedent…
The FBI Warned About Fake Permit Fees. The Harder Question Is Where the Money Goes.
A fast-growing scam impersonates city and county planning departments, sending property owners real-looking invoices for fake permit fees and pressuring them to wire payment on…
Threat Hunting Case Study: Scattered Spider
In a recent episode of Intel 471’s Happy Hunting series, we broke down Scattered Spider, a group behind several high profile breaches over the past…
Understanding Illicit Ecosystems: How Dark Web Forums Structure Cybercrime
When a high-profile data breach hits headlines, the default assumption is often to view the dark web as a single, centralized marketplace where any illicit…