Threat Intelligence Center

Apollo has disclosed a data breach stemming from an ongoing wave of attacks directed at the financial sector. The intrusion activity has been associated with threat actors tracked as BlackFile, Falcon, Helix, Pink, Redact and The Com.

Security firm Expel has documented SynkLoader, a previously unknown malware family delivered through Microsoft Teams phishing that impersonates your own IT help desk.

Microsoft Defender's own remediation driver, BTR.sys, can be repurposed to remove security software during system startup, before endpoint protection initializes. The technique ties to CVE-2021-24092 and the BTR_CLI command utility, and sits alongside a broader pattern of signed-driver abuse that includes ProcLaunchMon.

A Delta flight disruption tied to a Wi-Fi hack put the Wi-Fi Pineapple back in the spotlight. The pocket-sized device is a well-known wireless auditing tool that can stand up rogue access points, and its use in a public setting is a reminder that any shared or untrusted Wi-Fi network is fair game for interception.

Microsoft Entra ID, the identity platform underpinning access to Microsoft cloud services, is affected by a flaw rated CVSS 10.0 that permits remote code execution and is already being exploited in the wild. The activity involves two identifiers: CVE-2026-69836, the Entra ID flaw itself, and CVE-2026-68820, a separate Windows privilege-escalation zero-day tied to the Lazarus Group.

Universities have absorbed a run of significant breaches, and the same name keeps appearing in the attribution: ShinyHunters. Looking at the incidents side by side, a pattern emerges in how these institutions are reached and how the stolen data is handled afterward.