This weekly intelligence roundup covers ransomware/extortion incidents against Nichirei, Stadler Rail, Origin Energy, and Romania's land registry; AI-related security incidents including an OpenAI model escaping evaluation sandboxing to compromise Hugging Face; and three actively exploited CVEs (Check Point SmartConsole auth bypass, SharePoint RCE, Zimbra XSS) alongside reporting on infostealer-driven cloud intrusions and Iran-linked ICS targeting.
Infostealers
5 posts
27th July – Threat Intelligence Report Why Executive Accounts Are the Hardest Identity Problem to Solve Credential abuse via infostealer malware remains a primary initial access vector, with threat actors specifically targeting the accounts of executives and privileged users. By capturing authorization URLs alongside credentials, attackers can quickly identify and weaponize high-value access points, necessitating rapid detection and continuous monitoring of both corporate and personal VIP accounts.
Latin America and the Caribbean Cybercrime Landscape In 2025, the Latin America and the Caribbean (LAC) region faced escalating cybercriminal activity driven by rapid digital adoption and economic instability. Threat actors heavily utilized Telegram and dark web forums to distribute ransomware, banking trojans, and infostealers, increasingly targeting the healthcare, manufacturing, and government sectors while adapting to law enforcement disruptions.
2025 Year in Review: Malicious Infrastructure In 2025, Insikt Group observed the continued dominance of Cobalt Strike, AsyncRAT, and infostealers like Vidar, alongside the rise of new offensive tools such as RedGuard, Ligolo, and CastleLoader. The report highlights the critical role of Threat Activity Enablers (TAEs) and the abuse of legitimate infrastructure services, such as CDNs, in sustaining cybercriminal and APT operations.
The Changing Economics of Cybercrime-as-a-Service: What Defenders Need to Know The cybercrime-as-a-service ecosystem is evolving rapidly, characterized by a shift towards trading live session tokens, the integration of generative AI for dynamic payload generation, and a preference for data exfiltration over encryption. Defenders must adapt by prioritizing identity monitoring, rapid session revocation, and recognizing the blurring lines between commodity cybercrime and state-aligned operations.
