Threat Intelligence Center

Threat intelligence analysis has revealed a complex intrusion campaign where the Storm-2603 threat actor deployed Velociraptor to conduct parallel attack operations within a single compromised environment. Rather than pursuing a single objective, the attacker leveraged the same initial access point to execute multiple concurrent threat chains, complicating detection and response efforts.

Microsoft has attributed a supply chain attack involving the Mastra AI framework to BlueNoroff and Sapphire Sleet, North Korean threat actors. The attack leverages compromised easy-day-js dependencies and PowerShell backdoors to target cryptocurrency exchanges and financial institutions.

Security researchers monitoring DShield and cowrie honeypots have documented a sustained campaign of coordinated SSH brute force attacks originating from Chinese botnet infrastructure over the past three months. This guest diary analysis reveals specific attack patterns, targeting methodologies, and the scale of reconnaissance activity targeting exposed SSH services.

Security researchers analyzing Evil MSI malware have identified a sophisticated evasion technique leveraging BASE64 statistical analysis. The attack employs custom Python utilities including base64dump.py, byte-stats.py, and translate.py to manipulate encoding patterns and evade signature-based detection systems.

The Icarus threat actor group has claimed responsibility for an expanding OAuth breach targeting Klue, a market intelligence and competitive insights platform used across CRM, cybersecurity, pharmaceutical, and software sectors. The attack leverages Python scripts to exploit OAuth authentication mechanisms, with the victim list continuing to grow as researchers document affected organizations.

Security researchers have identified an active attack campaign delivering Remcos Remote Access Trojan through VHDX virtual disk files. This attack chain targets professional service firms including medical, legal, and accounting practices. The VHDX file format is being exploited as an initial delivery vector, leveraging user trust in virtual machine files to bypass traditional email filtering.