Threat Intelligence Center

Muneeb Akhter and Sohaib Akhter's case demonstrates a critical insider threat: a terminated employee leveraged artificial intelligence to obscure the deletion of customer data from a hosting firm's infrastructure. The incident, under federal investigation, reveals how departing employees with system access can weaponize AI to destroy evidence and complicate forensic recovery.

Security researchers have identified a sophisticated campaign distributing ModeloRAT malware through Microsoft Teams, targeting professional service firms including legal, medical, and accounting practices. The attack chain leverages multiple tools—DumpIt, Pmanager.py, and collector.py—to establish persistence and escalate privileges toward domain compromise.

Security researchers at HiddenLayer identified a malicious repository impersonating an OpenAI privacy filter that achieved #1 ranking on Hugging Face with 244,000 downloads. The fake package contains multiple malware payloads including ValleyRAT, CodeRun102.exe, Winos 4.0, and information stealer variants designed to compromise developer environments.

Microsoft's May 2026 Patch Tuesday release addresses 51 security vulnerabilities across Windows operating systems, Exchange Server, and Microsoft Office products. The update includes patches for critical remote code execution flaws and elevation of privilege issues that could expose professional service firms to active exploitation.

ShinyHunters, a known threat actor group, has successfully breached Zara and compromised nearly 200,000 customer records. This incident is part of an escalating pattern of attacks by the group targeting multiple industries including retail, healthcare, EdTech, gaming, video streaming, and analytics platforms.

Credential-based attacks—including phishing, brute force, and credential stuffing—remain the leading attack vector against medical practices, law firms, and accounting organizations. ThreatDown ITDR (Identity Threat Detection and Response) identifies suspicious authentication patterns, compromised credentials, and lateral movement attempts in real time.