Threat Intelligence Center

As threat actors increasingly deploy autonomous AI agents to conduct reconnaissance and exploitation, traditional security controls face a fundamental challenge: detection lag.

The Cybersecurity and Infrastructure Security Agency has added multiple ConnectWise and Windows vulnerabilities to its Known Exploited Vulnerabilities catalog following confirmed active exploitation by APT28 and Storm-1175 threat actors.

Microsoft has announced a firm deprecation timeline for legacy Transport Layer Security protocols in Exchange Online, effective July 2024. Organizations still using TLS 1.0 and 1.1 for email connectivity will experience service disruptions unless they upgrade to TLS 1.2 or higher.

The TeamPCP supply chain campaign has resumed operations following a 26-day hiatus, deploying three concurrent compromises targeting critical developer infrastructure. Attackers have infiltrated Checkmarx KICS, Bitwarden CLI, and xinference packages on PyPI, while simultaneously distributing CanisterSprawl, a newly identified npm worm.

Security researchers have identified a coordinated fraud campaign leveraging 120 instances of Keitaro Traffic Distribution System (TDS) to deliver fake CAPTCHA phishing attacks. Attributed to threat actors TA2726 and FaiKast, the operation targets cryptocurrency users and telecommunications subscribers through SMS-based social engineering.

Retrieval-augmented generation (RAG) pipelines have become standard in enterprise SaaS applications, enabling AI systems to access and synthesize proprietary data. However, these systems introduce a new attack surface: prompt injection vulnerabilities that allow attackers to manipulate queries, bypass access controls, and exfiltrate sensitive information.