Threat Intelligence Center

ShinyHunters, a known threat actor group, has been observed deploying backdoor access into education sector networks to establish persistent access and exfiltrate sensitive student information. This campaign targets institutional databases containing enrollment records, personally identifiable information, and authentication credentials.

Rapid7 researchers have documented active exploitation of CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect portal. Unknown threat actors are leveraging this vulnerability to bypass authentication controls on remote access infrastructure, potentially gaining unauthorized entry to enterprise networks.

Security researchers have identified BTMOB, an Android malware service attributed to ScarCruft and associated threat actors Johnk3r and Merl, that generates custom phishing payloads targeting banking, cryptocurrency, government, and streaming service users. The malware leverages related tools including BirdCall, NoVoice, and SpySolr to deliver tailored phishing campaigns.

Recent SEC filings have disclosed operational details about SALT TYPHOON and VOLT TYPHOON, two state-sponsored threat actors conducting sustained campaigns against critical infrastructure, financial services, and telecommunications sectors. These filings provide rare insight into attack methodologies, dwell times, and lateral movement techniques used by these actors.

Threat actors targeting cryptocurrency and DeFi projects have shifted tactics from obvious typosquatting to sophisticated package impersonation attacks. Rather than relying on misspelled package names, attackers now create near-identical packages with realistic naming conventions that closely mirror legitimate libraries.

The FBI has identified a critical social engineering campaign where threat actors impersonate legitimate tech support personnel to convince employees to install remote access software.