Threat Intelligence Center

Huntress researchers have documented Gentleman ransomware campaigns targeting construction and shipping firms through sophisticated defense evasion techniques. The threat actors leverage AnyDesk for remote access, deploy the G_hlm7jj_windows_amd64.exe payload, and execute Windows Defender tampering via Trojan:Win32/MpTamperBulkExcl.H to disable endpoint protection.

Security researchers have identified a coordinated phishing campaign leveraging EvilTokens and Kali365 tools to compromise Microsoft 365 accounts despite MFA protections. This attack bypasses traditional authentication by harvesting session tokens through credential interception, allowing attackers to access email, cloud storage, and document-sharing services without triggering MFA challenges.

Crypto drainers have emerged as a sophisticated threat targeting decentralized finance participants and NFT holders. Variants including Inferno Drainer, Lucifer DaaS, and tools like Angel, Ghost, Medusa, Monkey, Nova, Vega, and Venom operate through malicious smart contracts designed to siphon cryptocurrency directly from connected wallets.

Artificial intelligence has fundamentally altered the threat model for travel technology platforms, booking systems, and hospitality networks. Traditional security controls designed for static environments no longer adequately protect against AI-enabled reconnaissance, credential stuffing at scale, and automated vulnerability discovery.

Security researchers at ReliaQuest have observed active exploitation of CVE-2024-12802 in SonicWall VPN appliances to circumvent multi-factor authentication protections. The attackers, who have not been publicly identified, exploit incomplete patching to gain unauthenticated access, then deploy Cobalt Strike beacons for lateral movement and reconnaissance.

The FBI has documented $388 million in losses attributed to scams involving cryptocurrency ATMs during 2025, marking a significant threat to both individual users and financial institutions. These attacks exploit the pseudonymous nature of cryptocurrency transactions and the physical accessibility of ATM networks. The losses form part of a broader wave of cryptocurrency fraud that has ensnared tens of thousands of victims worldwide.