Browse public community intelligence reports, source analysis, and threat research.
4 intel reports
A Russian-speaking Aurora ransomware affiliate utilizes AI-assisted planning and Active Directory exploits to compromise over twenty organizations globally before deploying a Zig-based encryptor.
Certighost (CVE-2026-54121) is a critical improper authorization vulnerability in AD CS allowing low-privileged users to impersonate Domain Controllers by abusing unverified directory referrals.
Attackers can abuse Active Directory Certificate Services (ADCS) to obtain trusted TLS certificates and hijack DNS to perform MITM attacks against Microsoft Entra ID logins.
dMSA Ouroboros is a persistence technique in Windows Server 2025 that uses self-referencing GroupMSAMembership and Shadow Credentials to automate the extraction of NT hashes from superseded accounts.
