Threat Intelligence Center

Cybersecurity image illustrating the takedown of SocGholish disrupting threat vectors in digital security and data protection.

A coordinated law enforcement operation has successfully disrupted SocGholish and associated traffic direction systems (TDS) including JunkyTDS, Keitaro, and ParrotTDS. These tools, attributed to Evil Corp and TA569, have been instrumental in distributing malware to banking institutions, healthcare providers, educational organizations, and government agencies.

AI-driven cybersecurity image showcasing advanced threat intelligence for data protection against Qakbot and Scattered Spider.

Indicators of compromise alone are no longer sufficient to detect advanced threat actors like Qakbot and Scattered Spider, which deploy tools including WarmCookie, PUA.Win.Tool.Kmsactivator, Win.Tool.Procpatcher, and Win.Worm.Coinminer across cybersecurity firms, market research organizations, and public transport entities.

Cybersecurity concept illustrating threat vectors targeting Fortinet customers in diverse industries for data protection.

The UK National Cyber Security Centre has issued guidance for Fortinet customers following active exploitation of FortiBleed, an infostealer malware deployed by an organized eCrime gang. The threat spans five critical industries: automotive, IoT, music and streaming services, technology, and telecommunications.

Cybersecurity illustration depicting threat vectors targeting Cisco SD-WAN flaws, emphasizing data protection and digital security.

Security researchers have confirmed that threat actor UAT-8616 exploited multiple Cisco SD-WAN vulnerabilities—CVE-2026-20127, CVE-2026-20182, and CVE-2026-20245—for approximately two months before Cisco's official disclosure. This timeline gap represents a significant window of exposure for service providers relying on SD-WAN infrastructure.

Conceptual image illustrating cybersecurity threats exploiting COM objects for evasion and persistence in digital security.

Threat actors are systematically exploiting Windows Component Object Model (COM) interfaces to evade endpoint detection and maintain persistent access to compromised systems. COM abuse allows malware to execute code through legitimate Windows processes, bypass behavioral analysis, and establish footholds that survive reboots.

Conceptual image illustrating cybersecurity threats from malicious npm packages targeting digital security and data protection.

Security researchers have identified a sophisticated supply chain attack targeting the npm ecosystem. Malicious packages impersonating legitimate PostCSS tools deliver BeaverTail, a Windows Remote Access Trojan associated with threat actors PolinRider and abdrizak.

Cybersecurity image illustrating disrupted Amadey and StealC malware network, highlighting data protection and threat vectors.

Law enforcement agencies have successfully disrupted a significant malware distribution network operated by InCrease, YouTubeTA, and plymouth threat actors. The operation recovered 27 million stolen credentials and disrupted infrastructure supporting Amadey, StealC, Agent Tesla, AsyncRAT, RedLine Stealer, Lumma Stealer, and other credential-harvesting malware.

Threat Intelligence Center

SocGholish Takedown Disrupts JunkyTDS and ParrotTDS Operations

AI-Enabled Threat Intelligence Moves Beyond IOCs to Stop Qakbot and Scattered Spider

FortiBleed Infostealer Hits Fortinet Customers Across Five Industries

Attackers Hit Cisco SD-WAN Flaw 2 Months Before Disclosure

Windows Threats Abuse COM Objects to Evade Detection and Persist

Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT

Amadey and StealC Malware Network Disrupted, 27M Credentials Recovered

More Articles …

About Us

Areas We Serve

Get the latest news!