Threat Intelligence Center

Threat actors are systematically targeting higher education institutions through coordinated phishing campaigns designed to harvest credentials, followed by sophisticated MFA exploitation techniques. These attacks focus on administrative and faculty accounts that provide access to student records, financial systems, and research data.

Security researchers have documented a sophisticated attack pattern leveraging native macOS primitives for post-compromise movement and execution. Attackers abuse legitimate tools including Git, Netcat, Terminal.app, bash, osascript, and socat to establish persistence and move across networks without deploying traditional malware.

LeakNet threat actors have been observed exploiting ConnectWise ScreenConnect vulnerabilities to establish persistent access within managed IT environments serving legal, accounting, and medical firms. The attack chain involves deploying MeshAgent alongside tools like Shai-Hulud, Tactical RMM, and Tycoon 2FA to maintain control and bypass authentication mechanisms.

Security researchers tracking Metasploit Framework activity have documented a coordinated exploitation campaign leveraging CompatTelRunner as an initial access vector. The attack chain combines CVE-2025-68109 and CVE-2026-28501 to deploy Meterpreter payloads, with attackers abusing Microsoft BITS and PowerShell for command execution and lateral movement.

Security teams scanning professional service networks are discovering unauthorized AI model deployments, including instances of Claude, OpenAI, HuggingFace, and associated tools like ClawdBot, MoltBot, and OpenClaw. These unmanaged AI implementations create significant compliance and data exposure risks, particularly for medical, legal, and accounting firms handling sensitive client information.

When attackers compromise a domain account, the window to contain the threat is measured in minutes. This case study examines how predictive shielding technology identified anomalous behavior patterns associated with a domain compromise and automatically isolated the threat before lateral movement could propagate across the network.