Intel Exchange

A Chinese-speaking operator nicknamed 'Miku' conducted a global campaign involving SQL injection, credential spraying, and LLM-assisted reconnaissance against government, military, and commercial targets in Pakistan, Vietnam, and Mexico.

A Russian threat actor named LeakySensey has compromised over 87,000 devices by brute-forcing legacy VPN protocols and modified Claude Code AI to automate the operation.

An unidentified attacker compromised 3BB's network in Thailand, deploying MeshCentral for persistence and targeting subscriber RADIUS databases after attempting to exploit FortiGate SSL-VPN vulnerabilities.

A Chinese-speaking operator utilized rogue Redis replication and multi-protocol exploit toolkits to compromise 3,562 servers for XMRig cryptomining across Asia and Europe.

A Russian-speaking operator compromised over 14,000 Dahua IP cameras globally, primarily in Ukraine and Russia, using authentication bypasses, P2P relay abuse, and credential brute-forcing.

Attackers can achieve full Active Directory domain takeover in under one hour using legitimate protocols like Kerberos and SMB without deploying malware.

BREEZE COMET targets Brazilian financial services and payment systems like Pix using a custom multi-language malware suite and AI-accelerated tradecraft.

An Akira ransomware affiliate targeted a SonicWall VPN to exfiltrate data and attempted to bypass security controls by rebooting the victim host into Safe Mode.

Threat actor UAT-11764 and ransomware groups Sinobi and Warlock are weaponizing QR phishing and legitimate RMM tools like MeshAgent to bypass MFA and maintain persistent access.

Threat actors are spoofing OAuth client IDs in Microsoft Entra to perform stealthy user enumeration and credential validation without generating successful sign-in logs.