--- title: Threat Intelligence Center - Capstone Technologies Group description: Q1 2026 incident response data shows phishing reclaims top initial access vector. Public administration agencies face persistent targeting. Analysis of attack… canonical_url: https://captechgroup.com/threat-intelligence-center?start=175 language: en-GB date: 2025-08-13T00:46:48Z notice: This is a machine-friendly version of the page at https://captechgroup.com/threat-intelligence-center?start=175. markdown-tokens: 1317 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/threat-intelligence-center?start=175. Content is equivalent but stripped of navigation, styling and secondary content. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. [ ![Conceptual image illustrating phishing as a key threat vector in cybersecurity for public admin data protection.](https://images.captechgroup.com/cdn-cgi/image/width=515,format=webp,quality=85/threat-intel/b3d5e117a0.jpg) ](https://captechgroup.com/threat-intelligence-center/phishing-reemerges-as-top-initial-access-vector-in-1b401b "Phishing Reemerges as Top Initial Access Vector in Q1 2026 Public Admin Attacks") Q1 2026 incident response trends reveal a significant resurgence of phishing as the leading initial access vector for breaches, particularly targeting public administration agencies. While defenders shifted focus to other attack surfaces in recent years, threat actors have refined phishing campaigns with improved social engineering and credential harvesting techniques. [ ![Conceptual image illustrating cybersecurity threats, highlighting Formbook malware's evasion tactics for data protection.](https://images.captechgroup.com/cdn-cgi/image/width=515,format=webp,quality=85/threat-intel/0b36bbca19.jpg) ](https://captechgroup.com/threat-intelligence-center/formbook-malware-campaign-uses-obfuscation-to-evad-af86ee "Formbook Malware Campaign Uses Obfuscation to Evade Detection Across Firms") Security researchers have identified an active Formbook malware campaign leveraging multiple obfuscation techniques to avoid detection by traditional security controls. The campaign distributes Formbook alongside other information-stealing malware including AsyncRAT, Remcos, SmokeLoader, and XWorm. [ ![Conceptual image illustrating cybersecurity threats, phishing, and MFA exploitation in higher education data protection.](https://images.captechgroup.com/cdn-cgi/image/width=515,format=webp,quality=85/threat-intel/0dda5813c8.jpg) ](https://captechgroup.com/threat-intelligence-center/phishing-and-mfa-exploitation-targets-higher-educa-7bf02d "Phishing and MFA Exploitation Targets Higher Education Keys to Kingdom") Threat actors are systematically targeting higher education institutions through coordinated phishing campaigns designed to harvest credentials, followed by sophisticated MFA exploitation techniques. These attacks focus on administrative and faculty accounts that provide access to student records, financial systems, and research data. [ ![Conceptual image illustrating macOS tools exploited for lateral movement in cybersecurity and data protection.](https://images.captechgroup.com/cdn-cgi/image/width=515,format=webp,quality=85/threat-intel/c272398b2d.jpg) ](https://captechgroup.com/threat-intelligence-center/macos-native-tools-weaponized-for-lateral-movement-e55678 "macOS Native Tools Weaponized for Lateral Movement and Code Execution") Security researchers have documented a sophisticated attack pattern leveraging native macOS primitives for post-compromise movement and execution. Attackers abuse legitimate tools including Git, Netcat, Terminal.app, bash, osascript, and socat to establish persistence and move across networks without deploying traditional malware. [ ![Cybersecurity illustration showing threat vectors in ConnectWise ScreenConnect for data protection and digital security.](https://images.captechgroup.com/cdn-cgi/image/width=515,format=webp,quality=85/threat-intel/f0a1fa3ef9.jpg) ](https://captechgroup.com/threat-intelligence-center/leaknet-exploits-connectwise-screenconnect-to-depl-0dd9e7 "LeakNet Exploits ConnectWise ScreenConnect to Deploy MeshAgent Across Professional Firms") LeakNet threat actors have been observed exploiting ConnectWise ScreenConnect vulnerabilities to establish persistent access within managed IT environments serving legal, accounting, and medical firms. The attack chain involves deploying MeshAgent alongside tools like Shai-Hulud, Tactical RMM, and Tycoon 2FA to maintain control and bypass authentication mechanisms. [ ![Cybersecurity image illustrating threat vectors from unauthorized AI models in enterprise networks for data protection.](https://images.captechgroup.com/cdn-cgi/image/width=515,format=webp,quality=85/threat-intel/5334dc262f.jpg) ](https://captechgroup.com/threat-intelligence-center/scanning-for-ai-models-reveals-unauthorized-claude-c26212 "Scanning for AI Models Reveals Unauthorized Claude, OpenAI Deployments in Enterprise Networks") Recent security assessments have identified unauthorized AI model deployments across enterprise networks, including instances of Claude, OpenAI, HuggingFace, and associated tools like ClawdBot, MoltBot, and OpenClaw. [ ![Cybersecurity image illustrating threat vectors and data protection in enterprise networks using Metasploit exploits.](https://images.captechgroup.com/cdn-cgi/image/width=515,format=webp,quality=85/threat-intel/847d659604.jpg) ](https://captechgroup.com/threat-intelligence-center/metasploit-wrap-up-04172026-exploits-compattelrunn-d2566f "Metasploit Wrap-Up 04/17/2026 Exploits CompatTelRunner in Enterprise Networks") Security researchers tracking Metasploit Framework activity have documented a coordinated exploitation campaign leveraging CompatTelRunner as an initial access vector. The attack chain combines CVE-2025-68109 and CVE-2026-28501 to deploy Meterpreter payloads, with attackers abusing Microsoft BITS and PowerShell for command execution and lateral movement.