Threat Intelligence Center

Fifteen separate stories this week, and each one touches software your team already trusts. A Qilin suspect was handed to German authorities, a Gentlemen affiliate called Azazel kept the extortion money and leaked data on his own site, and VulcanRAT207 arrived over WhatsApp as "Statement.exe".

Phishing controls are concentrated at the email layer, where secure email gateways filter messages, rewrite links, and flag external senders, while awareness training asks users to catch what gets through. That approach treats a delivered message as the failure point. The compromise, however, occurs further down, at credential entry, authentication, and session handling.

The FBI warns that FortiBleed, a Russian-speaking operation, remains active after amassing 86,644 credentials from Fortinet devices. The operation's toolset includes FortigateSniffer along with Hashmat and Hashtopolis, and its activity has been linked to INC Ransom and Lynx ransomware. Credentials on exposed Fortinet devices should be treated as compromised.

Chinese hackers tracked as TA419 are impersonating US officials in an AI-focused cyber espionage campaign. The activity uses Frameless BitB, a browser-in-the-browser technique that renders a counterfeit sign-in window inside an attacker-controlled page, so the URL bar users inspect is drawn by the page itself. The intelligence summary does not name targeted industries.

Cybersecurity heading into 2026 spans a wide set of segments, from endpoint and identity protection to detection and response, data security, and the tooling that supports security operations.

Scammers gained control of Microsoft's official X account and used it to promote cryptocurrency schemes to its followers. Infostealer malware is associated with the activity, a reminder that stolen credentials and session tokens remain a practical route to high-profile social media account takeover. Corporate accounts with large followings are high-value targets for this kind of fraud.