Analysis of active threat actors and campaigns, including APT tradecraft, attack infrastructure, law enforcement takedowns, and indicator of compromise reporting. Articles map adversary behavior to MITRE ATT&CK techniques and document the tooling and infrastructure behind intrusions.
The Cl0p extortion group exploited CVE-2026-12569, a deserialization flaw in PTC Windchill and FlexPLM, to steal engineering data from Shell, Philips, General Electric, Fiserv, and roughly 45 other companies. Unlike Cl0p's MOVEit campaign, this operation skips file encryption and targets CAD files, blueprints, and supply chain documentation.
The U.S. Justice Department and FBI seized domains powering the QScan and QTRouter platforms operated by PRC-state group QTFY (Nanjing Xinjiuwei Network Technology Company), used since at least 2018 to target NASA, the Federal Reserve, DOE, DOJ, HHS, NIH, and the U.S. Senate. DOJ later corrected its statement to clarify the agencies were targets, only some of which were compromised.
Reconnaissance frameworks, attack-surface discovery engines, and public-data enrichment platforms.
Phishing campaign platforms, security awareness testing tools, and credential harvesting simulators.
Adversary emulation platforms, C2 frameworks, and atomic test libraries for authorized red team operations.
Threat intelligence platforms, IOC sharing communities, and STIX/TAXII tooling for collecting and distributing threat data.