Intel Exchange

UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.

Threat actors are abusing legitimate Microsoft Power BI domains to host phishing lures that deliver multiple rogue ScreenConnect instances for persistent remote access.

Qilin (aka Agenda) is a high-volume Russian-speaking RaaS operation targeting global manufacturing and healthcare sectors through credential abuse and advanced EDR evasion.

An unidentified threat actor utilizes renamed Python interpreters and custom ._pth files to execute malicious code without command-line arguments, eventually attempting to deploy ScreenConnect via a UAC bypass.

Silent Ransom Group (Luna Moth) is conducting high-value data extortion campaigns against US law firms using a combination of vishing and physical office intrusions to exfiltrate sensitive data.

ShinyHunters (UNC6240) is targeting healthcare through identity-access extortion using vishing/AitM kits and mass exploitation of CVE-2026-35273 in Oracle PeopleSoft.

Luna Moth (Silent Ransom Group) uses voice-based callback phishing to trick victims into installing legitimate RMM tools for data extortion without using encryption.

Threat actors are leveraging malicious ChatGPT Custom GPTs to social engineer victims into executing PowerShell-based ClickFix attacks that deliver sophisticated Remote Access Trojans.

Unattributed threat actors are leveraging legitimate MSP360 RMM and ConnectWise ScreenConnect installers via phishing to establish persistent remote access and deploy post-compromise tools.

An attacker-controlled ScreenConnect client is being distributed via phishing emails as a legitimate, signed executable to gain remote access to victim systems.