Threat Intelligence Center

Security researchers have identified a coordinated supply chain attack attributed to Lazarus, a North Korea-linked threat group, distributing malicious npm packages that impersonate legitimate Rollup polyfill libraries.

Defence Impairment Olympics is a targeted attack campaign that disables Windows Defender security controls using the DisableDefender.ps1 script, paired with exploitation of CVE-2023-26360, CVE-2023-29298, and CVE-2023-29300. The campaign deploys additional payloads including UA4fp7R.aspx, WRBYTR5750images.aspx, and i.bat to establish persistence and lateral movement.

DisableDefender.ps1 is a PowerShell script that switches off Windows Defender's core protections, clearing the way for attackers to steal credentials and run malicious tools without triggering alerts. Huntress recovered it as part of a larger batch file, i.bat, during an incident it responded to on June 7.

Security researchers have linked FortiBleed credential theft activity to coordinated ransomware operations by INC Ransom and Lynx, threat actors targeting critical infrastructure sectors. The attack chain leverages EKZ Stealer and a Golang-based sniffer to harvest credentials from compromised Fortinet appliances, establishing persistence for subsequent ransomware deployment.

CISA's July 2, 2026 advisory discloses two vulnerabilities affecting ST Engineering iDirect iQ-Series satellite communication terminals deployed across critical infrastructure sectors including the defense industrial base, energy, government services, and transportation systems. These terminals serve as network access points for organizations requiring resilient, remote communications.

Security researchers have identified a malware distribution campaign in which the VEIL#DROP threat actor leverages the Blogger platform to deliver PureLogs stealer to target systems. This attack chain exploits the trust associated with legitimate hosting services to bypass email filters and endpoint detection.

Threat researchers have identified ARToken, an affiliate panel operated by the EvilTokens group, actively targeting Microsoft 365 accounts across multiple regulated industries including finance, human resources, life sciences, and logistics. The ARToken panel, distributed through the Portal Browser tool, focuses on credential harvesting and account compromise.