Threat Intelligence Center

Grafana has released patches addressing a vulnerability in its AI functionality that posed a risk of user data exposure. The bug, present in specific versions of the platform, could have allowed unauthorized access to sensitive information through the AI feature set.

Law enforcement agencies have disrupted FrostArmada, a DNS hijacking campaign that exploited compromised routers to intercept and redirect traffic, enabling credential theft from Microsoft 365 users across government, hosting provider, information technology, and law enforcement sectors.

Identity compromise remains the primary entry point for attackers targeting enterprise networks. Microsoft Active Directory and Microsoft 365 environments face persistent threats from credential theft, lateral movement, and privilege escalation attacks.

Google Workspace deployments face escalating identity-based threats including account compromise, credential abuse, and lateral movement across cloud infrastructure. Without dedicated Identity Threat Detection and Response (ITDR) capabilities, organizations struggle to identify malicious access patterns buried within normal user activity.

The cybersecurity landscape has fundamentally changed. Traditional reactive defense—waiting for alerts, patching vulnerabilities after exploitation, responding to breaches—leaves organizations vulnerable to sophisticated attackers who operate faster than security teams can respond.

Security researchers have identified a malware campaign leveraging DonutLoader to distribute malicious scripts disguised as ad-removal tools. The attack chain uses PowerShell execution to inject payloads into Windows systems, exploiting user trust in legitimate ad-blocking utilities. Analysis reveals the threat targets end users through deceptive packaging and social engineering.