Tim Peck

ServiceNow instances running the Australia release or specific legacy configurations were vulnerable to unauthorized data queries via an unauthenticated REST API endpoint.

Threat actors are increasingly leveraging compromised Microsoft Intune administrative accounts to deploy malicious scripts and perform fleet-wide device wipes.

An OS command injection vulnerability in Ivanti Sentry allows unauthenticated remote attackers to achieve root-level code execution via a specific API endpoint. (CVE-2026-10520)

Threat actors use PowerShell scripts to bypass standard process monitoring, but defenders can leverage the DeviceEvents table in Microsoft Defender XDR to gain visibility into individual command executions.

A likely Iran-nexus activity cluster is deploying BLUERABBIT, a Golang-based backdoor that utilizes RabbitMQ, Redis, and MinIO for C2 and exfiltration prior to disk wiping and ransomware deployment.

Threat actors can abuse the Microsoft WinGet configure command and COM APIs to execute arbitrary PowerShell scripts via YAML files, bypassing standard process monitoring.

Chaotic Eclipse is leveraging zero-day vulnerabilities YellowKey and MiniPlasma to bypass BitLocker and achieve SYSTEM-level privilege escalation on Windows 11 and Server environments.

Microsoft Defender now utilizes Windows Filtering Platform (WFP) integration to monitor inbound remote RPC calls at the OpNum level to detect lateral movement, credential theft, and discovery.

An unknown threat actor is using JavaScript and PowerShell to deliver .NET malware hidden via steganography in MSI-branded JPEG images hosted on legit services.

A threat actor operating as Leda Elacoate is conducting a supply chain campaign using trojanized installers for crypto-trading and VPN software to deploy the STX RAT infostealer via DLL sideloading.