Ransomware operators are scaling their attacks, and the barriers to entry continue to fall. In the first half of 2026, Flashpoint identified 6,256 ransomware attacks across industries, representing a 45% increase between 2025 and 2026, as Ransomware-as-a-Service (RaaS) operations expanded and threat actors increasingly leveraged AI, stolen credentials, and vulnerability exploits to accelerate their campaigns.

The impact is widespread. Manufacturing accounted for 18% of observed attacks, followed by business services and consulting (13%) and healthcare (9%). Meanwhile, prolific ransomware groups such as Qilin and Akira continue to demonstrate the scale at which these operations can function.

Understanding how ransomware attacks develop, and where they can be interrupted, is critical for defenders.

Introducing Ransomware in the Age of AI: A Survival Guide for Defenders

Flashpoint’s new guide, Ransomware in the Age of AI: A Survival Guide for Defenders, provides cyber threat intelligence professionals, threat hunters, and security leaders with a practical look at the modern ransomware attack lifecycle, from initial reconnaissance and access to incident response and recovery.

Drawing on Flashpoint’s primary-source intelligence and analysis of evolving threat actor tactics, the guide explores how organizations can identify opportunities to disrupt attacks before they escalate, strengthen incident response, and reduce the risk of repeat compromise.

Access the guide to learn:

• How modern ransomware attacks unfold: Follow the attack lifecycle, from reconnaissance, phishing, and initial access through lateral movement, encryption, and ransom negotiations.
• Where defenders can intervene: Understand how compromised credential monitoring, vulnerability intelligence, and visibility into underground activity can help identify threats before attackers reach critical systems.
• How AI is reshaping ransomware operations: Explore how AI-enabled capabilities, commoditized tooling, and RaaS ecosystems are changing the economics and execution of ransomware attacks.
• How to strengthen response and recovery: Learn strategies for containing active incidents, restoring operations, improving cross-team coordination, and reducing exposure to repeat attacks.

Understanding the Modern Ransomware Attack Lifecycle

Ransomware attacks rarely begin with encryption. Long before systems are locked or ransom demands appear, threat actors may be gathering intelligence on potential targets, exploiting exposed vulnerabilities, or acquiring stolen credentials through underground marketplaces.

Flashpoint observed a 27% increase in infostealer operations in H1 2026 compared to H1 2025, underscoring the growing role of compromised identities in the ransomware ecosystem. Stolen credentials and session data can provide attackers with access to organizational environments, potentially allowing them to bypass traditional defenses and establish a foothold.

These initial access methods are increasingly interconnected with broader criminal operations. RaaS groups can leverage specialized tools and services throughout the attack chain, while AI-enabled capabilities offer additional opportunities to automate and accelerate certain activities.

This creates multiple opportunities for defenders to act. Intelligence about exposed credentials, emerging exploitation activity, and threat actor behavior can help security teams identify risks earlier and prioritize defensive action before an intrusion progresses.

The guide examines these opportunities across the ransomware lifecycle, outlining how proactive intelligence and coordinated response can help organizations minimize operational disruption and strengthen resilience.

Build a More Proactive Defense Against Ransomware

As ransomware operations continue to evolve, organizations need visibility into the threats targeting their environments and the intelligence to respond at every stage of an attack.

From identifying compromised credentials and monitoring emerging threats to containing incidents and preventing repeat attacks, a lifecycle-based approach helps security teams make more informed decisions before, during, and after a ransomware incident.

Get the Ransomware in the Age of AI: A Survival Guide for Defenders to explore the modern ransomware attack lifecycle and learn how Flashpoint’s threat intelligence can help your organization anticipate, disrupt, and recover from ransomware attacks.

Contact Sales

In the first half of 2026, Flashpoint tracked more than 22 million threat actor posts discussing, sharing, or advertising AI toolkits for criminal deployment. The figure reflects AI’s growing presence across the cybercriminal underground, where adversaries are using new capabilities to accelerate attacks and develop malicious tooling with fewer resources.

For enterprise defenders, these developments are adding pressure to threat intelligence programs already managing high alert volumes, limited analyst capacity, and expanding responsibilities.

During Flashpoint’s recent webinar, we examined the evolving threat landscape alongside findings from Flashpoint’s Global Threat Intelligence Report: 2026 Midyear Edition and new enterprise threat intelligence research.

Missed the live webinar? We’ve rounded up the key takeaways below, and the full session is now available to watch on demand.

AI Is Changing the Economics and Speed of Cybercrime

AI is helping threat actors develop capabilities and execute attacks faster, reducing the time and expertise required for activities that previously demanded greater resources.

Several developments illustrate the broader shift in cybercrime economics and attack velocity:

• Initial access costs have declined by approximately 69%, reflecting the continued commoditization of access to compromised environments.
• Attackers published 637 malicious package versions in just 22 minutes during a software supply chain compromise.
• Nearly one in five vulnerabilities disclosed during the first half of this year had public or functional exploit code available, narrowing the window for defenders to address exposed systems.

AI is primarily accelerating established techniques, particularly during the early stages of the attack chain, including reconnaissance, social engineering, vulnerability discovery, and exploitation.

For defenders, this creates an opportunity to identify and disrupt malicious activity during its preparation stages. However, it also raises expectations around how quickly intelligence teams can recognize emerging threats, prioritize relevant findings, and act before an attack progresses.

AI Is Changing How Cybercriminals Develop Tools and Share Knowledge

AI is also changing how threat actors acquire the skills and capabilities needed to carry out attacks, creating new challenges for intelligence collection.

Historically, underground communities enabled cybercriminals to collaborate, exchange expertise, and obtain specialized services. Increasingly, threat actors can use AI to troubleshoot code, develop malicious tooling, and learn unfamiliar techniques independently, reducing their reliance on public collaboration.

Reduced activity in underground communities does not necessarily mean cybercriminal activity is declining. While forums, encrypted messaging platforms, and other illicit communities remain important intelligence sources, collection strategies must account for changes in how and where adversaries develop and distribute their capabilities.

Threat Intelligence Teams Are Struggling to Keep Up with Growing Demands

As adversaries accelerate their operations, enterprise threat intelligence teams are contending with growing workloads and limited resources.

Independent research commissioned by Flashpoint surveying threat intelligence budget owners and influencers at large North American enterprises identified several leading operational challenges:

• 65% cited alert noise and false positives.
• 55% identified analyst bandwidth and effectiveness.
• 50% pointed to the evolving threat landscape.
• 50% cited tool integration and interoperability challenges.

Note: Respondents could select up to three challenges.

High alert volumes, disconnected systems, and manual investigations consume analyst time that could otherwise be spent addressing emerging threats.

As one healthcare threat intelligence leader explained:

“Good analysts take time to develop and train, and we can’t hire our way out of that problem.”

These challenges are prompting organizations to examine how they can improve existing workflows, reduce repetitive investigations, and make better use of analyst expertise.

Threat Intelligence Budgets Are Growing, with AI Threats Leading Investment Priorities

Despite operational pressures, organizations are continuing to invest in threat intelligence.

Flashpoint’s research found that 50% of respondents expect their threat intelligence budgets to increase over the next 12 months, including 35% anticipating increases of at least 10%. Another 40% expect budgets to remain essentially flat, while 0% anticipate a decrease.

AI-related threats emerged as the leading priority for expanded intelligence coverage, particularly:

• Deepfakes and synthetic media, including their use in impersonation, fraud, and social engineering.
• AI-accelerated vulnerability exploitation, as adversaries identify and exploit weaknesses more quickly.
• Emerging AI-enabled attack vectors, including changes in threat actor tactics, techniques, and procedures.

Organizations are also investing in additional intelligence feeds, expanded security use cases, and further development of their intelligence programs.

These priorities reinforce the importance of translating AI-related threats into specific intelligence requirements aligned with organizational risk.

Agentic AI Adoption Is Underway, but Trust and Measurable Value Remain Essential

Alongside investments in AI-related threat coverage, organizations are exploring how agentic AI can improve their own intelligence operations.

Flashpoint’s research found that:

• 25% are already using agentic AI in production.
• 20% are piloting agentic AI or conducting proofs of concept.
• 35% are planning adoption within the next 12 to 24 months.
• 20% are taking a wait-and-see approach.

Early implementations focus primarily on information retrieval, alert prioritization, contextual enrichment, intelligence platform queries, and MITRE ATT&CK mapping.

Organizations remain more cautious about granting agents autonomy over consequential actions, such as blocking IP addresses or changing security controls.

One research participant captured the concern:

“An agent that’s confidently wrong is worse than one that’s slow.”

Accuracy, data privacy, auditability, predictable costs, and human oversight remain central considerations. Organizations also expect AI investments to demonstrate measurable value through time savings, improved efficiency, and faster response.

Preparing Your Threat Intelligence Strategy for 2027

As organizations prepare for 2027, four priorities can help guide threat intelligence planning:

1. Plan for threats you cannot readily observe. Identify potential gaps in intelligence collection and examine emerging attack methods, including weaknesses in internal security processes.
2. Prepare for machine-speed attacks. Evaluate detection, prioritization, and response capabilities against increasingly compressed attack timelines.
3. Turn AI threats into actionable intelligence requirements. Map emerging techniques to relevant adversaries, established frameworks, defensive controls, and business risks.
4. Use agentic AI where it can extend analyst capacity. Prioritize repeatable workflows that deliver measurable value while maintaining appropriate data controls and human oversight.

Watch 22 Million Reasons to Rethink Your 2027 Threat Intelligence Strategy for a deeper look at the cybercriminal underground, enterprise threat intelligence investment trends, and practical considerations for agentic AI adoption.

Contact Sales

More than 3.7 million fraudulent online accounts removed. Twenty-eight arrests across Ghana and Nigeria. More than $11 million in potentially freezable funds identified. And 117 human trafficking victims identified.

These were among the results of Joint Disruption Week, an international operation targeting criminal networks responsible for online fraud, including cryptocurrency investment scams, impersonation schemes, and financial extortion.

“Transnational criminal scam networks operating from West Africa suffered major disruptions last week during a coordinated international ‘Joint Disruption Week,’ an effort that produced arrests, seizures, and the largest-ever takedown of fraudulent social media accounts linked to scam centers in the region.”

Department of Justice

Hosted by the UK’s National Crime Agency (NCA) in London during the week beginning October 6, 2026, Joint Disruption Week brought together investigators from the DOJ, FBI, U.S. Secret Service, Homeland Security Investigations, and international law enforcement agencies, alongside private-sector organizations including Flashpoint.

Throughout the week, participants exchanged real-time intelligence and developed investigative leads to support enforcement actions in Ghana and Nigeria, as well as the disruption of online accounts and infrastructure used by scam networks.

The operation targeted criminal organizations whose activities extend across borders and online platforms. According to the DOJ, scam centers operating in West Africa share characteristics with those previously identified in Southeast Asia, including organized recruitment, training in social engineering techniques, and coordinated fraud campaigns targeting victims internationally. Some operations also involve human trafficking, with individuals coerced into participating in fraudulent activities.

By bringing together law enforcement and private-sector capabilities, Joint Disruption Week targeted both the infrastructure used to perpetrate fraud and the individuals behind these schemes.

Joint Disruption Week: The Results

The coordinated effort produced results across criminal investigations, financial intelligence, and online infrastructure disruption.

According to the DOJ:

• 28 suspects were arrested, including 19 in Ghana and nine in Nigeria.
• More than 3.7 million fraudulent accounts, Pages, and Groups were removed from online platforms.
• 117 human trafficking victims were identified in Ghana, awaiting repatriation to Nigeria.
• 89 fraud victims were identified in Ghana, associated with approximately $8.3 million in reported financial losses.
• More than $11 million in potentially freezable funds were identified through private-sector investigative efforts.
• More than 30 suspected scam centers were referred to law enforcement for further investigation.
• 356 electronic devices were seized during enforcement actions in Ghana and Nigeria.

The figures illustrate the reach of these operations. Millions of accounts can support criminal activity across multiple platforms, while the individuals directing those activities may be operating thousands of miles from their intended victims.

Disrupting the Infrastructure Behind Online Fraud

The arrests and account removals represent different aspects of the same challenge: identifying the individuals behind criminal operations while disrupting the infrastructure they use to reach victims.

Online scam networks can operate across social media platforms, messaging services, and financial systems, with evidence of criminal activity spread across multiple organizations and jurisdictions. Investigations often depend on connecting information from these different sources to identify the actors involved and the infrastructure supporting their operations.

During Joint Disruption Week, private-sector partners contributed by removing fraudulent accounts, identifying potentially recoverable funds, and sharing investigative leads with law enforcement.

Flashpoint was among the organizations specifically recognized by the DOJ for participating in the operation, alongside Meta, Microsoft, Google, OpenAI, Coinbase, Binance, Chainalysis, Elliptic, TRM Labs, and others. For threat intelligence teams, operations like this highlight the value of identifying criminal actors, understanding how their operations are structured, and connecting activity across disparate sources to support investigative action.

Together, the arrests, account removals, and financial investigations demonstrate how coordinated efforts can target multiple components of criminal operations, from the infrastructure used to perpetrate fraud to the individuals responsible.

Continuing Efforts to Disrupt Scam Networks

Joint Disruption Week marked the first coordinated international operation focused specifically on West African scam networks, according to the DOJ.

The arrests, infrastructure disruptions, and investigative leads generated during the operation represent progress against criminal organizations responsible for large-scale financial fraud and human exploitation.

Flashpoint continues to support efforts to identify and disrupt criminal activity through primary source intelligence that helps investigators understand emerging threats and the networks behind them.

For additional information on the operation and its results, read the full Department of Justice announcement.

Contact Sales

Threat intelligence teams are heading into 2027 with more than ever to monitor, driven by an acceleration in the AI threat landscape. However, their expanded mandate typically doesn’t come with a proportional budget windfall. Instead, teams are under pressure to get greater value from the intelligence, systems, and analyst expertise already available to them.

New independent research commissioned by Flashpoint shows where that pressure is being felt most. Alert noise and false positives are the most frequently cited challenges affecting threat intelligence program effectiveness, followed by analyst bandwidth, changes in the threat landscape, and integration across security tools. At the same time, AI-related threats have emerged as the leading area where practitioners want to expand intelligence coverage.

These findings point to some of the decisions that will shape threat intelligence programs in the year ahead: where to focus finite analyst capacity, how intelligence requirements need to evolve, and where AI can meaningfully support the work. Organizations are already evaluating agentic AI across threat intelligence workflows, but the research also shows that greater autonomy comes with higher expectations around accuracy, control, and measurable value.

For security leaders planning their 2027 threat intelligence strategy and budgets, this report examines:

• Which operational challenges are putting the greatest pressure on analyst capacity and threat intelligence programs today.
• How intelligence requirements are changing as AI-enabled threats create new coverage priorities.
• How threat intelligence budgets are trending in the next 12 months, and where incremental budgets will go.
• Where practitioners see the strongest applications for agentic AI, and which AI-powered workflows face a higher threshold for trust and autonomy.
• What teams need to prove before expanding AI investment, including the metrics practitioners are using to evaluate time savings, accuracy, risk reduction, and ROI.

Together, the findings provide a practical benchmark for teams evaluating their own intelligence operations: where to focus limited analyst time, where automation may have the greatest impact, and what to measure as AI becomes part of the workflow.

Executive Summary

As threat intelligence teams plan for 2027, the research shows them managing two simultaneous pressures: intelligence requirements are expanding, while the capacity available to address them remains constrained. AI is intensifying that pressure as adversaries adopt new capabilities, but also becoming part of how organizations are thinking about scaling their ability to defend their organizations.

Four findings stand out:

• The AI threat landscape is accelerating faster than threat intelligence teams can keep up. Alert noise and false positives were the most frequently cited challenge, identified by 65% of respondents, while 55% cited insufficient analyst bandwidth and half pointed to integration gaps across their security tools.
• Threat intelligence budgets are rising to close the gap. Half of respondents expect their budgets to increase over the next 12 months, including 35% anticipating meaningful increases of 10% or more. Another 40% expect spending to remain essentially flat. No respondents anticipate a decrease. Where budgets are growing, organizations are directing investment toward areas including AI-related threat coverage, additional intelligence feeds and modules, and broader program development.
• AI-related threats are the leading priority for expanded coverage and new investment. Practitioners pointed to deepfake detection, AI-accelerated vulnerability exploitation, and emerging AI-enabled threat vectors as areas where their intelligence requirements are expanding.
• Agentic AI adoption is underway, but teams are setting a high bar. Just 25% of organizations interviewed are using agentic AI in production today. Another 20% are piloting it, while 35% are planning adoption within the next 12 to 24 months. Rather than rushing toward autonomy, teams are evaluating where agents can improve workflows while maintaining intelligence quality, appropriate controls, and human oversight.

Taken together, the findings show where threat intelligence teams are feeling the greatest pressure, where they see opportunities to extend their capabilities with AI, and what will determine whether those tools earn a lasting place in the intelligence workflow. The sections that follow examine each of these findings in greater detail and what they mean for threat intelligence programs.

Operational Challenges Are Putting Pressure on Analyst Capacity

The rising AI threat landscape is increasing pressure on organizations to get more capacity from the people and systems they already have. Threat intelligence leaders therefore say the biggest barriers to program effectiveness are operational: too much noise, limited analyst bandwidth, and disconnected tools.

Alert noise and false positives emerged as the leading challenge affecting threat intelligence programs, cited by 65% of respondents. Analyst bandwidth followed at 55%, while half of respondents pointed to both the evolving threat landscape and integration gaps across their security tools.

The impact of these challenges becomes clearer at the workflow level. One healthcare practitioner described receiving alerts about email breaches that were seven or eight years old, with the same data resurfacing each time it was resold and requiring another investigation. Practitioners also described manual steps between intelligence feeds, SIEMs, SOAR platforms, ticketing systems, and response workflows.

Each unnecessary investigation or manual handoff consumes time that could otherwise go toward analysis. That becomes difficult to solve through hiring alone because threat intelligence expertise takes time to develop. As one healthcare threat intelligence leader explained:

“Good analysts take time to develop and train, and we can’t hire our way out of that problem.”

The research suggests an opportunity to look for capacity within the intelligence workflow itself. Reducing repetitive investigations, improving integration between systems, and helping analysts identify relevant intelligence faster can return more of their time to work that depends on context and judgment.

Threat Intelligence Investment Remains Resilient Heading Into 2027

The rise of AI-driven threats is driving increases in the intelligence budgets of many organizations. Among respondents who provided a budget outlook, 50% expect their threat intelligence budgets to increase over the next 12 months, while the remaining 40% expect budgets to stay essentially flat. None anticipate a decrease.

More than a third (35%) expect meaningful growth of at least 10%, suggesting that for many organizations, threat intelligence remains an area of active investment heading into 2027.

Where organizations are increasing investment is equally important. Respondents expecting meaningful growth described spending on AI defense capabilities, expanded threat intelligence feeds and modules, and broader program development. AI-related threat coverage also emerged across both flat and growing budgets as the most frequently cited area where teams want to expand coverage.

For teams heading into 2027, the findings suggest that the question is increasingly where to direct threat intelligence investment for the greatest impact. Organizations are evaluating how existing resources can address new intelligence requirements, where additional capabilities are needed, and which investments can demonstrate clear operational value.

AI-Related Threats Are Driving New Coverage Priorities

As organizations decide where to focus threat intelligence investment in the year ahead, AI is the clear priority. AI-related threats were the most frequently cited area where organizations want to expand intelligence coverage, including among teams with relatively flat budgets. Practitioners specifically pointed to deepfake detection, AI-accelerated vulnerability exploitation, and emerging AI-enabled threat vectors.

These priorities reflect activity already visible across the threat landscape. During the first half of 2026, Flashpoint tracked more than 22 million threat actor posts discussing, sharing, or advertising AI toolkits for criminal deployment. Flashpoint analysts observed AI being used across phishing, malware development, evasion, and vulnerability exploitation.

For threat intelligence teams, expanding AI coverage requires more specificity than treating “AI threats” as a single monitoring category. Deepfakes may matter because of executive impersonation or fraud. AI-accelerated exploitation may change vulnerability monitoring and prioritization. New attack tooling may affect the adversaries or TTPs a team already tracks.

The challenge extends beyond visibility into these threats. Organizations also need the expertise to understand how AI is changing adversary behavior and attack chains. That expertise is still developing. As one practitioner put it, “everybody’s learning it at the same time.”

Connecting those developments to existing PIRs and business risks gives analysts clearer collection priorities and helps teams determine what new sources, expertise, and monitoring they actually need.

Those requirements are also expanding at a time when analyst bandwidth is already constrained, creating a second question for threat intelligence leaders: where can AI support the intelligence workflow itself?

Agentic AI Adoption Is Underway

Nearly half of the organizations interviewed are already using or piloting agentic AI in threat intelligence workflows, while another 35% are planning adoption within the next 12 to 24 months. That makes agentic AI an important part of 2027 planning, but despite the attention surrounding it, threat intelligence teams are taking a measured approach. They are looking for clear business value, evidence that AI can maintain the quality of their intelligence workflows, and appropriate human oversight as agents take on more consequential tasks.

The work being handed to agents already varies considerably, from information retrieval and alert prioritization to more active tasks such as blocking IP addresses, updating blacklists, and monitoring suspicious traffic. Organizations in the pilot stage also described use cases spanning detection, validation, context generation, SIEM alert analysis, TIP querying, MITRE ATT&CK mapping, and reversible response actions.

As agents move from retrieving and analyzing information to taking actions that can directly affect security operations, accuracy and trust become increasingly important. One respondent captured the concern succinctly:

“An agent that’s confidently wrong is worse than one that’s slow.”

That concern is reflected across the research. Practitioners raised questions around data leakage, auditability, regulatory requirements, cost, and the level of control agents should have over security workflows. One retail respondent, for example, would only consider read-only AI assistants because of the risks associated with granting agents write permissions.

For teams evaluating agentic AI, that makes the workflow itself an important part of the decision. Tasks with reviewable outputs, reversible actions, and clear success criteria provide a practical starting point. As autonomy increases, teams need equally clear controls around what an agent can access, what it can change, where human approval is required, and how its actions are audited.

What the Findings Mean for Threat Intelligence Programs

As threat intelligence leaders plan for 2027, the research points to a clear set of priorities. Teams have more to monitor, limited analyst capacity, and growing interest in AI as a way to scale the work their programs already perform.

The findings also show that practitioners are selective about where they see that value. PIR coverage monitoring and intelligence briefings can extend coverage and reduce recurring work while keeping analysts involved in the intelligence process. As agents take on more consequential actions, questions around accuracy, permissions, auditability, and human oversight become more important.

For teams setting priorities for the year ahead, that creates a practical path forward: understand where analyst capacity is being consumed, connect new intelligence requirements to the risks that matter to the organization, identify workflows where automation can meaningfully extend the team, and establish clear measures of success before deployment.

The challenge for 2027 will be turning expanding intelligence requirements into an operating model that can scale for threat intelligence programs. That means making better use of existing data, systems, and analyst expertise while being deliberate about where agentic AI can extend those capabilities and where human judgment remains essential.

Methodology

Flashpoint commissioned independent qualitative research among a select group of more than 20 threat intelligence budget owners and influencers at large North American enterprises across financial services and insurance, healthcare and biotech, retail, and information technology and telecommunications during the early fall of 2026. 

Contact Sales

First discovered in April 2026, CastleStealer is a C#-based information-stealing malware that has continued to add new capabilities since its emergence. Newer samples analyzed by Flashpoint can bypass app-bound encryption in Chromium-based browsers, execute commands remotely, and exfiltrate stolen information in small encrypted transmissions rather than a single large archive.

While Flashpoint has not yet identified a large influx of threat actors using CastleStealer, its continued development makes it an emerging threat worth watching. 

What We Know About CastleStealer

CastleStealer was first publicly identified in April 2026, when it was observed using ClickFix social engineering to deliver a Python script that executed a loader referred to as “CastleLoader.”

By June, the malware had appeared in a different distribution campaign. Threat actors used malicious advertisements to direct victims to fake Node.js installation websites, where a batch script masquerading as an installer ultimately downloaded and executed a newer loader known as OXLOADER.

OXLOADER employs several techniques designed to make analysis and detection more difficult, including multiple rounds of self-decryption, obfuscated API resolution, sandbox checks, and in-memory execution. Flashpoint analysts assess that the loaders used to deliver CastleStealer appear to be developed in-house and demonstrate significant technical ability around anti-analysis and stealth. 

But the delivery chain is only one part of CastleStealer’s evolution. Newer samples show that the infostealer itself has continued to expand what it can collect and what threat actors can do after a system is compromised.

What Data Does CastleStealer Target?

Once executed, CastleStealer first checks the system’s Multilingual User Interface (MUI) languages for Russian (ru-RU). It then connects to its command-and-control (C2) infrastructure and sends a handshake packet containing its build UUID and basic information about the infected host. After establishing the connection, it gathers additional information about the victim machine and sends it to the C2. 

From there, CastleStealer begins searching for sensitive information across browsers, applications, and files on the victim’s system.

For Chromium-based browsers, CastleStealer collects login data, cookies, browsing history, web data, and information stored by browser extensions. That includes extension IDs, IndexedDB data, and extension storage. 

The malware also targets:

• Firefox: Login data, cookies, browsing history, and form history.
• Steam: Files including config.vdf, loginusers.vdf, and local.vdf, which can contain sensitive account information and settings.
• Discord and Telegram: CastleStealer searches APPDATA for directories associated with both applications.
• Files on the victim system: The malware broadly collects files while excluding several file types and files containing “backup.” It places particular emphasis on files containing “wallet” in their names.

That browser targeting has also become more capable since CastleStealer was first discovered.

Bypassing App-Bound Encryption

One of the clearest examples of CastleStealer’s evolution is its ability to target data protected by newer browser security controls.

Earlier analysis found that CastleStealer could not steal data from updated browsers using app-bound encryption. Newer samples analyzed by Flashpoint now use Chrome’s IElevator COM interface to bypass that protection, a technique also used by other modern infostealers.

The change closes a meaningful limitation present in earlier CastleStealer samples and expands the browser data available to the malware.

From Infostealer to Remote Access

Newer CastleStealer samples also give threat actors capabilities beyond stealing information from an infected machine.

CastleStealer contains basic remote shell functionality that allows an operator to send a shell command to the victim system, provide a file for execution, or send the URL of another payload that CastleStealer will download and execute. 

That capability gives an attacker additional options after the initial compromise. Instead of ending the operation once targeted information has been collected, an operator can interact with the infected system and introduce additional payloads.

How CastleStealer Exfiltrates Stolen Data

CastleStealer also differs from many other infostealers in how it sends stolen information back to its operators.

Rather than collecting stolen data into an archive and transmitting it to a C2 server or Telegram channel, CastleStealer sends smaller amounts of collected data over raw TCP. The transmissions are encrypted using AES.

Flashpoint analysts assess that transmitting data this way may help CastleStealer avoid network detections associated with a single spike caused by a large data transfer. 

The network packets follow a straightforward structure:

{4-byte size} → {AES IV} → {Encrypted Data}

Once CastleStealer completes its activity, it deletes itself using a common ping-delay self-deletion technique.

Protect Against Emerging Infostealers Using Flashpoint

CastleStealer’s development since its discovery illustrates how quickly an emerging infostealer can mature. Its operators have changed how the malware reaches victims, while the stealer itself has gained the ability to bypass browser protections, remotely execute commands and additional payloads, and exfiltrate stolen data in smaller encrypted transmissions.

CastleStealer has not yet seen the widespread adoption associated with more established infostealer families. But its trajectory makes it one to watch as its developers continue to improve both its collection capabilities and what operators can do after compromising a victim.

Flashpoint continuously monitors emerging malware, illicit communities, and threat actor infrastructure to identify these shifts as they happen. Request a demo to learn how Flashpoint’s primary source intelligence and analyst research help security teams identify emerging threats and respond before they become widespread.

Contact Sales

In today’s threat landscape, speed and actionable context are critical. When a high-priority threat emerges, pairing best-in-class threat intelligence data with hyper-responsive human expertise ensures organizations can act immediately and with confidence. To turn raw threat data into actionable defense, Flashpoint unites unmatched primary source collection, cutting-edge AI features, and over 100 analysts fluent in more than 35 languages—ensuring organizations receive localized context, rapid analysis, and long-lasting strategic value.

Flashpoint Customer Success & Support (CS) consistently delivers industry-leading responsiveness and resolution speed. Driven by strict internal Service Level Objectives (SLOs), our metrics showcase our commitment to our customer’s operational success:

• 95% CSAT Score*: The Flashpoint CS team delivered consistent high-satisfaction across every customer interaction.
• 2.5 Hours Time to Solve*: Our industry experts swiftly resolve myriad support inquiries and operational blockers.

*CSAT and Time to Solve figures are based on real customer inputs from January 1, 2026 to September 2026.

This commitment to responsiveness is why we were honored to recently be named a Customer Favorite in The Forrester Wave: External Threat Intelligence Service Providers, Q3 2026 report, where Forrester specifically noted that “customers laud Flashpoint’s white-glove approach to addressing diverse customer needs.” 

But what does top-level service look like behind the scenes? 

Here is a look at how Flashpoint CS operates as an extension of our customers’ security operations.

Flashpoint Industry Leaders, An Extension of Your Team

Unlike traditional CS models that limit you to a single point of contact, customers are supported by Flashpoint’s entire team of Customer Success Managers (CSM) experts. Our team is comprised of former intelligence operators and seasoned practitioners whose collective experience spans decades across critical industries and sectors, including:

• Healthcare
• Financial Services & Banking
• Vulnerability Management
• Public Sector
• Defense Sector
• Retail & Enterprise Security

Flashpoint customers are paired with a dedicated CSM who can seamlessly draw on our broader team of industry specialists. Flashpoint customers gain speedy, highly knowledgeable insights without bottlenecks. This model provides organizations with timely responses for any urgent specific sector threats, with our CS teams bringing in practitioners who have direct, real-world experience in that field.

More Than Just Support

In addition to traditional support, Flashpoint’s CS team also support clients with:

1. Tailored Onboarding & Workflows: CS works closely with new teams to configure platform workflows, set up alert parameters, and ensure rapid time-to-value from day one.
2. Interactive Training Modules & Flash Talks: Customers gain access to regular, practitioner-led sessions and training modules designed to help analysts level up on advanced platform features and emergent threat trends.
3. Proactive Enablement: Beyond issue resolution, CS provides complimentary training modules, success briefings, routinely-scheduled Flash Talks, and self-service support portal resources to keep security operators informed of evolving threat trends.
4. Community-Driven Events & FUSE: CS bridges the gap between intelligence and execution by connecting customers at our annual FUSE conference, where hundreds of security leaders collaborate on real-world workflows, cross-functional defenses, and advanced platform execution.

Proven Track Record: Voice of the Customer

Flashpoint is a customer-first intelligence provider; we turn customer feedback into action. Our CS teams serve as the direct voice of the customer, taking feature requests and quality-of-life updates to Flashpoint Ignite product managers and engineers to help shape product roadmaps.

Real-world examples of how customer feedback directly drives platform enhancements include:

• Expanding Card BIN Support for Financial Fraud Teams: When a top-10 U.S. bank raised concerns about card data visualization, CS brought the Fraud Product Manager directly into the conversation. This led to dashboard and API fixes alongside brand-new features delivered within a  month.
• Increasing Export Limits for High-Volume Investigations: Facing a critical project deadline, a risk-intelligence consultancy hit the export limit during a large-scale social media search. CS escalated the issue to product engineering, resulting in a permanent increase to the results per export for all Flashpoint customers.
• Resolving Integration Blockers for Global Insurers: When critical vulnerability and intelligence alerts weren’t reaching a global insurer’s SOC tools, CS collaborated directly with Flashpoint’s integrations engineering team to update, release, and verify the integration end-to-end.
• Unlocking Capacity for Enterprise Scaling: When a major Canadian bank approached their contractual API usage limit, their CSM partnered with Flashpoint leadership to secure expanded capacity, ensuring uninterrupted threat monitoring.

Remove Blockers Using Flashpoint

Powerful intelligence technology is only half the equation—unmatched operational support is what drives long-term success. Customer feedback reinforces our belief that Flashpoint’s recognition as a Forrester “Customer Favorite” mirrors our commitment to pairing world-class threat data with exceptional service. Request a demo and see how the combination of best-in-class data and unparalleled customer service strengthens your security operations to maximize your threat intelligence investment.

About Forrester

Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester’s objectivity here.

Contact Sales

Contact Sales

Contact Sales

Following Operation Epic Fury, regional kinetic operations have transitioned into direct, persistent threats against commercial shipping, energy infrastructure, and critical supply chains.

The Flashpoint Threat Intelligence Brief: Middle East cuts through headline noise to deliver tactical, ground-level intelligence for government agencies, corporate security leads, and global logistics teams—turning Flashpoint’s primary source intelligence into proactive risk mitigation.

Here is what your security operations team needs to track this week.

Operational SITREP: Executive Summary

Between October 16 and October 22, Ansarallah (the Houthi movement) expanded its operations against Yemeni government forces, striking the Al-Alam training center in Shabwa governorate with three ballistic missiles on October 19. Local officials reported at least 53 people killed and more than 200 wounded. Houthi forces also reportedly advanced into western Taiz city and claimed additional attacks against Saudi-aligned forces.

The United Kingdom announced it would deploy Royal Air Force (RAF) Typhoon fighter jets, an A400M transport aircraft, and military advisers to strengthen Saudi Arabia’s defenses against Houthi missile and drone attacks. The deployment comes as Saudi authorities continue responding to strikes against aviation infrastructure and other targets.

Inside Iran, reports of renewed US military strikes against Iranian facilities remained disputed. Iranian sources alleged attacks on the Kenarak naval base and an Islamic Revolutionary Guard Corps (IRGC) anti-ship missile unit in Sirik, although a US official rejected the Kenarak account and neither incident has been independently confirmed. Iran also placed border forces on maximum alert, conducted ballistic missile launches, and reinforced preparations for potential renewed hostilities.

Regional tensions extended into Iraq’s Kurdistan region, where Iranian ballistic missiles and drones struck Kurdish opposition positions near Erbil on October 21. Iraq began closing its border crossings with Iran the same day, following Pakistan’s closure of its second crossing earlier in the reporting period.

Maritime attacks continued in the Strait of Hormuz and waters off Saudi Arabia, with UKMTO reporting a tanker damaged by unknown projectiles northeast of Jubail.

In the cyber domain, Iranian authorities issued binding directives to cut domestic access to the international internet if another war begins. Separately, the Handala Hack Team claimed breaches of Israeli military units and personnel, while new research documented the use of online advertising infrastructure to deliver Candiru spyware.

Kinetic & Maritime Risk

The expansion of Houthi operations into southern Yemen adds another front to an already sustained campaign against Saudi Arabia. Beyond the October 19 strike in Shabwa, Ansarallah forces reportedly advanced into western Taiz, approaching the Old Airport neighborhood and Taiz University. The group also claimed to have downed a Saudi military helicopter near Najran, although Saudi authorities have not confirmed the loss. Meanwhile, the UK’s deployment of RAF Typhoon fighter jets and military advisers will provide additional defensive support to Saudi Arabia while increasing the number of Western military assets exposed to Houthi attacks.

Preparations for potential renewed hostilities between Iran and Israel also intensified. Iran’s reported “Code 100” maximum border alert coincided with ballistic missile activity near Urmia and an Israeli long-range strike exercise involving dozens of fighter jets and reported US aerial refueling support. Iranian sources separately alleged US strikes against military facilities at Kenarak and Sirik, although neither incident has been independently confirmed and a US official disputed the Kenarak account. Together, these developments point to heightened military readiness, even as the timing and likelihood of renewed large-scale operations remain uncertain.

Iran’s strikes against Kurdish opposition positions near Erbil introduce additional security concerns for organizations operating in Iraq’s Kurdistan region. The attacks followed Iranian statements concerning the potential expulsion or transfer of Kurdish opposition members from Iraq, while the closure of border crossings by Iraq and Pakistan further complicates overland movement and commercial logistics.

At sea, the threat extends beyond the Strait of Hormuz to waters off Saudi Arabia. UKMTO reported a tanker damaged by unknown projectiles northeast of Jubail, while separate reporting identified another tanker struck in the Red Sea. Iranian claims of additional incidents, including a purported mine strike in the Strait of Hormuz, remain unverified. The continued attacks across multiple maritime corridors complicate transit planning for commercial shipping and energy operators.

Cyber and Hybrid Risk

New research from Citizen Lab and another research group identified how Israeli digital advertising agency Discover-Tech used a capability known as AdFection to track individuals and deliver Candiru spyware through ordinary online advertisements. The operation reportedly used advertising infrastructure spanning more than 120,000 websites and 75,000 applications, with targeted devices potentially compromised simply by loading a malicious advertisement. Targets included dozens of Al Jazeera journalists, while the advertisements also reached networks associated with the UN, NATO, the International Criminal Court, and the Pentagon.

The Handala Hack Team also claimed new compromises of Israeli military entities, including a media-monitoring and analysis center it associated with Unit 8200 and the commander of the IDF’s Yahalam combat engineering unit. The group published more than 500 purportedly classified documents and tens of thousands of alleged internal messages, attributing its access in part to sensitive operational information stored on personal devices. These claims have not been independently verified.

Meanwhile, Iranian authorities issued binding directives requiring domestic access to the international internet to be cut immediately if another war begins. The order raises the prospect of significant communications disruptions for businesses and personnel operating inside Iran. A Ukrainian intelligence assessment also reported cooperation between Russian and Iranian hacking groups targeting Israeli infrastructure, while Iranian opposition activists warned of a suspicious Telegram account impersonating Israeli military intelligence to solicit personal information and documents.

Recommended Risk Posture and Protective Controls

Organizations with personnel, facilities, or operations exposed to the conflict should reassess physical security, travel arrangements, maritime operations, and cyber defenses.

Cyber Defense

• Reduce exposure to malicious advertising: Review browser and network-level ad blocking, mobile device security, and spyware response procedures, particularly for journalists, government personnel, and other high-risk individuals.
• Prepare for hack-and-leak activity: Organizations with Israeli government or defense ties should review incident-response and communications plans and reinforce policies against storing sensitive operational information on unmanaged personal devices.
• Establish contingency communications: Organizations with staff, contractors, or partners in Iran should prepare alternate communication and check-in procedures that do not rely on international internet connectivity.
• Reinforce impersonation awareness: Personnel interacting with Iranian civil-society or diaspora communities should verify the identities of accounts claiming intelligence affiliations before sharing sensitive information.

Physical and Operational Defense

• Maintain heightened maritime security: Monitor UKMTO advisories and review transit risks in the Strait of Hormuz, waters near Jubail, and the Red Sea off Saudi Arabia.
• Review Saudi Arabia travel and facility security: Confirm flight availability, maintain alternate travel arrangements, and review shelter procedures amid continued missile and drone activity.
• Reassess operations near Erbil and regional border crossings: Review proximity to Iranian Kurdish opposition facilities, update emergency plans, and account for disruptions associated with Iraqi and Pakistani border closures.
• Review security at Western-linked facilities: Organizations associated with US or allied government operations should assess physical security and incident-reporting procedures in light of Iranian statements identifying Western political and infrastructure targets as potential objectives in renewed hostilities.

Strategic Outlook: Operational Forecast

Over the next 48–72 hours, Ansarallah is likely to sustain missile and drone pressure on Saudi cities and infrastructure while continuing operations against Yemeni government forces in Taiz, Shabwa, and Aden. The deployment of RAF Typhoon aircraft strengthens Saudi air defenses but also places additional UK personnel and equipment within range of potential Houthi attacks.

Iran’s maximum border alert, ballistic missile activity, and preparations for communications restrictions indicate heightened readiness for a possible resumption of large-scale hostilities. Israel’s recent long-range strike exercise reinforces concerns about further escalation, although renewed US-Israeli military action remains uncertain. Iranian strikes near Erbil and the closure of Iraqi and Pakistani border crossings also raise the possibility of further disruption to regional security and logistics.

Commercial shipping is likely to remain exposed to attacks in the Strait of Hormuz and surrounding waterways, while competing claims about responsibility will continue complicating incident assessments. In the cyber domain, Handala may release additional material it claims to have obtained from Israeli military sources, and intelligence collection, impersonation activity, and competing information narratives are likely to persist alongside physical threats.

Enhance Threat Intelligence Using Flashpoint

As the conflict continues to affect military operations, commercial shipping, regional infrastructure, and digital communications, security teams need timely intelligence to assess emerging risks and protect their organizations.

Flashpoint combines primary-source monitoring, open-source intelligence, and geospatial analysis to help organizations identify developing threats, assess operational exposure, and make informed security decisions.

Request a demo to learn how Flashpoint supports physical security intelligence, threat monitoring, and operational risk assessment.

Frequently Asked Questions (FAQs)

What is the Flashpoint Physical Threat Intelligence Brief?

The Flashpoint Physical Threat Intelligence Brief: Middle East is a recurring threat intelligence update that translates raw primary-source open-source intelligence (OSINT) and geospatial data into actionable physical security analysis. It focuses on kinetic conflict developments, standoff weapon capabilities, maritime corridor security, and critical infrastructure risks across the Middle East.

How does Flashpoint gather physical security intelligence for the Middle East?

Flashpoint Physical Security Intelligence (PSI) gathers data by combining global open-source intelligence (OSINT), geolocated social media signals, satellite imagery, and primary-source threat monitoring. The platform uses AI-driven natural language processing and geospatial mapping to track kinetic developments, weapon strike radiuses, and physical security threats in real time.

Contact Sales

Contact Sales

Contact Sales

Contact Sales

Unknowingly, a member of key personnel is living two separate lives. On the clock, they are a highly-trusted systems administrator, but in their personal time, they moonlight on the deep and dark web, advertising their trust and access to the highest bidder. One day, they get a simple offer: $15,000 in the crypto of their choice to approve a single push notification at 2 AM. They accept. By morning, the attacker walks away  with active domain admin credentials without the need for malware or cracking firewalls.

This is just one example of how insider threats lead to modern enterprise breaches. As perimeter security, EDR coverage, and other security tools mature, threat actors continue to target the human element, seeking employees and contractors willing to provide access to corporate systems or facilitate fraudulent activity.

In a threat landscape where identity is becoming the primary attack surface, monitoring illicit marketplaces and recruitment efforts is critical. This new monthly report leverages Flashpoint’s Primary Source Collection (PSC) to analyze insider threat tactics, tracking active recruitment and advertising on dark web forums and encrypted networks.

The Insider Threat Landscape: September 2026

In September 2026, Flashpoint analysts identified a total of 9,787 insider-related posts across 1,216 channels and 1,778 authors. While the volume of observed activity decreased, threat actors continued to actively seek and advertise insider access, particularly within industries where legitimate employee privileges can be exploited to facilitate fraud. These communications included threat actors attempting to recruit insiders at target organizations, insiders advertising their services, and general discussions involving insider-related threat activity.

Of these communications, Flashpoint observed 857 unique posts between September 1 and September 30, 2026.

The majority of these posts appeared in mid-tier English-language Telegram channels, where threat actors sought or advertised insider access to organizations across several industries. Much of the observed activity focused on recruiting insiders to facilitate fraud operations.

Where Insider Threat Activity is Concentrated

Retail, telecommunications, and financial services remained prominent targets for insider threat activity in September 2026. However, a significant portion of the observed activity could not be attributed to a specific industry.

Flashpoint found that 45.7% of unique insider posts fell into the “Unknown” category, meaning analysts could not determine the targeted organization or industry. Among posts with an identifiable industry, retail accounted for the largest share, followed by telecommunications, financial services, and technology.

Together, these four industries accounted for 419 unique posts, or nearly 49% of all unique insider-related activity observed during the month.

The concentration of activity in retail, telecommunications, and financial services reflects continued threat actor interest in insiders who may be positioned to facilitate fraud, provide access to customer accounts, or exploit legitimate organizational privileges.

The following table shows a breakdown of unique insider posts by industry in September 2026:

Industry	Posts
Other	392
Retail	135
Telecom	116
Financial	85
Technology	83
Public Sector	41
Healthcare	3
Media	2
Total	857

Insider Threats: Recruiting vs. Advertising

Active insider threats generally involve two types of activity: an insider is recruited by a malicious outside party, or an insider advertises their access and services to interested threat actors. These arrangements can enable adversaries to exfiltrate sensitive data, install malware, compromise accounts, or carry out fraudulent activities such as SIM swaps.

In September 2026, Flashpoint analysts identified 15 notable insider recruitment and advertising posts across underground communities and chat forums. Of these, nine involved threat actors attempting to recruit insiders, while six involved actors advertising insider services.

Telecommunications accounted for the largest number of notable posts, with five instances of recruitment or advertising. Retail and technology followed with three each, while financial services and the public sector accounted for two each.

These examples illustrate how threat actors continue to seek access across industries, with particular interest in employees and contractors who can facilitate fraud or provide privileged access to organizational systems.

Flashpoint also observed numerous insider solicitations repeated across multiple discussion threads, often with limited details about the access or services being offered. Analysts could not independently verify the legitimacy of the recruitment and advertising claims.

Protect Against Insider Threats Using Flashpoint

Insider threats are inherently difficult to detect using internal security controls alone because the malicious activity relies on valid credentials and legitimate access privileges. Relying solely on internal logs means security teams often only detect an insider threat after data exfiltration or system sabotage has already occurred.

Flashpoint protects organizations against insider threats through our Primary Source Collection (PSC) and specialized intelligence platforms:

• External Threat Intelligence & Early Warning: Flashpoint monitors deep and dark web forums, invite-only threat communities, and encrypted chat platforms to identify employee solicitations, stolen corporate domain mentions, and active recruitment attempts before an intrusion develops.
• Identity Protection & Infostealer Tracking: By tracking illicit marketplaces and infostealer activity, Flashpoint identifies compromised corporate credentials and active session tokens, preventing threat actors from utilizing purchased access.
• User & Entity Behavior Context: Flashpoint’s intelligence equips SOC, Security Operations, and Risk Management teams with adversary TTPs, enabling security operations to look for anomalous data downloads, off-hours access, or unauthorized software installation.

To learn more about how Flashpoint can help protect your enterprise from insider risk and monitor illicit underground communities, Request a Demo Today.

Frequently Asked Questions (FAQs)

What is the Flashpoint Insider Threat Report?

The Flashpoint Insider Threat Report is a monthly intelligence brief that analyzes trends, volume, targeted industries, and tactics surrounding insider threat recruitment and illicit access advertising on the deep web, dark web, and encrypted chat channels.

How does Flashpoint collect insider threat data?

Flashpoint collects data using its Primary Source Collection (PSC) engine, which actively monitors thousands of dark web forums, illicit marketplaces, and underground chat networks where threat actors and malicious insiders communicate.

What is the difference between insider recruitment and insider advertising?

Insider recruitment occurs when an external cybercriminal attempts to entice a corporate employee into assisting with a cyberattack. Insider advertising occurs when an employee or contractor proactively lists their legitimate access or services for sale on illicit marketplaces.

Contact Sales

Contact Sales

Blogs

Blog

Ransomware Risk Model: Flashpoint’s Patented Scoring Method to Inform Vulnerability Prioritization

Flashpoint was awarded U.S. Patent No. 12,705,360 for its Ransomware Risk model, which rates how closely new vulnerabilities match those used in ransomware attacks.

Vulnerability and exposure management (VM) teams need critical metadata and context that clearly show which issues pose an immediate risk to their organization. While traditional VM frameworks tell defenders how severe a vulnerability may be, they do not provide visibility into how likely threat actors are to exploit it. This leaves security teams overwhelmed in patch backlogs without a clear strategy for prioritization.

Nowhere is this prioritization gap more dangerous than with ransomware. Ransomware-as-a-Service (RaaS) groups no longer choose targets at random. They look for specific technical conditions that make vulnerability exploitation easy, fast, and repeatable. With RaaS attacks rising by 45% period-over-period in H1 2026, organizations need a way to identify the specific traits that make a vulnerability attractive to ransomware operators before an attack occurs.

Flashpoint built the Ransomware Risk score into Flashpoint Vulnerability Intelligence to solve exactly this problem. Since 2022, it has rated newly discovered vulnerabilities based on how closely they resemble those known to be used in ransomware attacks. With the grant of the U.S. Patent No. 12,705,360 on August 11, 2026, the methodology behind the score is now formally patented. This milestone formalizes Flashpoint’s ability to cut through the noise with a proven, threat-informed signal that gives defenders the clarity they need to act on Day Zero.

“As vulnerability disclosures surge, prioritization is more important than ever for security teams. A severity score alone can’t tell you which vulnerabilities pose the greatest real-world risk of exploitation by ransomware actors.

Our patented Ransomware Risk model applies years of threat intelligence to that problem, giving customers an earlier signal and helping them prioritize based on how attackers actually operate.”

josh lefkowitz, co-founder and ceo at flashpoint

Under the Hood: How Flashpoint’s Patented Ransomware Vulnerability Model Works

The patented system evaluates newly disclosed vulnerabilities against the patterns shared by vulnerabilities ransomware groups have exploited. Rather than trying to predict what threat actors will do next, the model learns what past ransomware-exploited vulnerabilities have in common and compares each new flaw against those patterns.

The Four Step Process

Multi-Factor Fingerprinting

Every vulnerability ingested into Flashpoint Vulnerability Intelligence is profiled against more than 60 distinct technical factors. This “fingerprinting” links the vulnerability to key inputs including whether the flaw is remotely exploitable without authentication, whether it affects SCADA or Operational Technology (OT) systems, and its potential impact on data availability, which is central to extortion schemes.

Coordinate Mapping

The model turns each multi-factor fingerprint into a set of values that place it as a single point on a map, so vulnerabilities with similar profiles land close together.

Identifying the Ransomware Neighborhood (Cluster Check)

Flashpoint overlays historical threat data onto the map to establish neighborhoods where vulnerabilities previously exploited in real-world ransomware attacks aggregate.

Similarity and Likelihood Rating

When a new vulnerability is ingested, its coordinates are checked against these neighborhoods. The scoring system calculates its spatial proximity to known ransomware vectors and assigns a clear rating: Low, Medium, High, or Critical.

This four-step method, developed by Flashpoint’s Ben Haynes and Jacob Kouns, is the basis of U.S. Patent No. 12,705,360.

What It Means for Vulnerability Management Teams

By translating complex structural attributes into a single risk score, the patented model delivers four key operational advantages:

1. Prioritize Beyond CVSS: Leveraging the Ransomware Risk model, security teams can confidently prioritize 1.0 to 6.9 CVSS issues if its structural profile lands it in a “High” or “Critical” ransomware cluster.
2. Act on Day Zero: Because the Flashpoint model rates all vulnerabilities on disclosure, security teams gain actionable guidance immediately, eliminating the need to wait weeks for external exploitation reports.
3. Effectively Communicate Risk: CISOs can present clear, business-centric risk statements rather than abstract numerical scores.
4. Adaptive Ratings: Scores update in near real time as vulnerability details change, and the model keeps adjusting as new vulnerabilities join the set it compares against.

Comprehensive Vulnerability Intelligence Integration

Flashpoint’s Ransomware Risk model is built to enhance, not replace the vulnerability management frameworks organizations already rely on. In fact, it provides even greater value for security teams as our Ransomware Risk model provides clarity for every vulnerability detailed by Flashpoint Vulnerability Intelligence, including over 105,000 issues missed by CVE and NVD.

Within Flashpoint Ignite, security teams have a complete view of vulnerability risk, seeing the score alongside CVSS (v3 and v4), EPSS, Social Risk, and exploit maturity.

Protect Against Vulnerability and Ransomware Risk Using Flashpoint

Vulnerability management requires more than cataloging. It demands threat-informed prioritization that aligns security operations with real-world business risk. Flashpoint’s patented Ransomware Risk model eliminates guesswork by surfacing the flaws that match the profile of known ransomware targets, allowing security teams to patch what matters most, first. 

By combining proprietary knowledge of vulnerability architecture and ransomware attacks, Flashpoint bridges the gap between theoretical and active exposure. Request a demo today to see how our Ransomware Risk model provides the definitive signal needed to stay ahead of extortion groups.

Ransomware Risk FAQs (Frequently Asked Questions)

What is the Ransomware Risk score? 

The Ransomware Risk score is a rating in Flashpoint Vulnerability Intelligence that shows how closely a vulnerability resembles those known to be used in ransomware attacks. Each vulnerability is rated Low, Medium, High, or Critical, so security teams can see which ones to patch first to reduce their ransomware exposure.

How is Ransomware Risk different from CVSS and EPSS?

CVSS measures how severe a vulnerability could be, and EPSS estimates how likely it is to be exploited in general. Ransomware Risk adds a ransomware-specific signal that works alongside both, showing how closely a vulnerability matches those ransomware groups have used. In Flashpoint Ignite, all three scores appear together.

What does Flashpoint’s ransomware patent cover?

U.S. Patent No. 12,705,360, granted August 11, 2026, covers Flashpoint’s method for rating how likely a vulnerability is to be used in a ransomware event. Each vulnerability is profiled on more than 60 factors, compared with vulnerabilities used in past ransomware attacks, and rated by similarity. The patent formalizes the model behind the Ransomware Risk score, live since 2022.

How often are Ransomware Risk scores updated?

Ransomware Risk scores update in near real time, so new vulnerabilities are rated as soon as they’re disclosed. The model also keeps adjusting as new vulnerabilities join the body it compares against, so ratings reflect the ransomware landscape as it stands today.

See Flashpoint in Action

Blogs

Blog

The Flashpoint Threat Intelligence Brief: Middle East

Flashpoint’s weekly analysis tracks shifting kinetic and cyber threat radiuses, geopolitical disruptions, and provides critical operational forecasts for the ongoing Middle East conflict.

Following Operation Epic Fury, regional kinetic operations have transitioned into direct, persistent threats against commercial shipping, energy infrastructure, and critical supply chains.

The Flashpoint Threat Intelligence Brief: Middle East cuts through headline noise to deliver tactical, ground-level intelligence for government agencies, corporate security leads, and global logistics teams—turning Flashpoint’s primary source intelligence into proactive risk mitigation.

Here is what your security operations team needs to track this week.

Operational SITREP: Executive Summary

Between September 25 and October 1, 2026, the Middle East conflict continued to expand geographically beyond the Gulf theater while diplomatic efforts stalled. Iranian intelligence activity reached European soil with the disruption of an alleged plot against a UK air base hosting US B-1 bombers, while US military forces completed their full withdrawal from Iraq.

In the Strait of Hormuz, IRGC-affiliated media claimed a massive anti-shipping campaign targeting 19 vessels over two days, though US officials disputed that any ships were struck during that window. On the diplomatic front, President Trump rejected Tehran’s seven-day proposal to reopen the strait in exchange for lifting the US naval blockade, signaling that renewed large-scale bombing of Iran after the November midterm elections remains possible.

In the digital domain, hacktivist collectives stepped up campaign activity under #OpIsrael and #OpUSA, and they have claimed to have compromised dozens of internet-exposed US CCTV systems and signaled imminent targeting of industrial control (SCADA) systems.

Kinetic and Maritime Risk

The physical conflict’s operational footprint has expanded into European staging locations. British police arrested five individuals near RAF Fairford over an alleged Iranian intelligence-backed plot to attack US B-1 bombers using vehicles laden with explosives. UK officials later said evidence indicated the possible linking of Iranian state actors to the attempt. In the Gulf, officials disclosed that eight US Marines sustained injuries—including possible traumatic brain injuries and smoke inhalation—during the September 14 Iranian strike on a US-contracted vessel.

In maritime chokepoints, conflict dynamics remain highly volatile. While IRGC-affiliated sources claimed 19 ships were targeted by anti-ship ballistic missiles and drones near Qeshm Island and Bandar Abbas, US officials disputed these numbers. Meanwhile, along the Red Sea, Ansarallah forces asserted control over key islands and the port of Mokha, prompting French naval escorts to shepherd commercial vessels through the Bab el-Mandeb Strait in recent weeks. Concurrently, US diplomatic pressure left roughly 20 empty Iranian oil tankers stranded off Sri Lanka running short of fuel or resupply.

Cyber and Hybrid Risk

Adversary operations across the cyber domain have shifted toward open-source reconnaissance, surveillance, and industrial control system (ICS) targeting.

Within the last week, a threat actor group published coordinates for an Israeli Air Force squadron and Field Intelligence site, alongside conducting Layer 7 DDoS attacks against US and Israeli targets. In parallel, Iranian state-aligned news outlets claimed cyberattacks had disrupted US-bound oil tankers and domestic refineries, while UAE authorities warned that attacks on port infrastructure were paired with cyber intrusions into connected industrial control systems.

Recommended Risk Posture and Protective Controls

To mitigate exposure across physical, maritime, and digital vectors, security operations leads should implement the following directive controls:

1. Tighten Perimeter Screening at European Installations: Facilities hosting US personnel or military assets across Europe should immediately review vehicle-screening protocols and reporting channels following the RAF Fairford plot.
2. Remove Exposed CCTV Portals & Segment SCADA/OT Networks: Industrial, energy, and logistics operators must take camera management interfaces off the public internet and enforce strict air-gapping/segmentation between IT networks and operational technology (OT/SCADA) environments.
3. Hardening Web Infrastructure Against Layer 7 DDoS: Organizations managing US or Israeli-facing web properties should activate origin-IP protections, Web Application Firewalls (WAFs), and aggressive rate-limiting against TLS-renegotiation and Layer 7 flooding tactics.
4. Reassess Non-Military Personnel Security in Iraq: Following the complete exit of US forces, commercial, diplomatic, and contractor entities in Iraq must update security postures to reflect the absence of co-located military quick-reaction forces.
5. Mitigate Doxxed Facility Exposure: Facilities linked to regional defense or security operations should review physical access controls and perimeter security, assuming published coordinate data is actively circulating among threat actors.

Strategic Outlook: Operational Forecast

The trajectory over the next 48 to 72 hours points to continued friction as diplomatic negotiations remain stalled. With Washington rejecting Iran’s seven-day proposal and signaling potential post-midterm strike campaigns, Iranian forces are likely to maintain high-profile messaging and anti-shipping operations in the Strait of Hormuz to demonstrate blockade-breaking capabilities.

In Europe, further disclosures regarding Iranian intelligence activity against Western staging bases remain probable. In the cyber domain, security teams should prepare for opportunistic probing against exposed SCADA and ICS interfaces, alongside continued low-impact hacktivist DDoS campaigns under #OpIsrael and #OpUSA.

Enhance Threat Intelligence Using Flashpoint

As hybrid threats unfold across the Middle East, passive monitoring is no longer enough to protect assets, personnel, and maritime operations. Rapidly shifting threat radiuses require security operations centers to operate on real-time, primary-source intelligence rather than delayed headline news.

Request a demo to see how Flashpoint equips government agencies, corporate security leads, and global logistics teams with real-time geolocated threat data, primary-source monitoring, and early-warning intelligence. By turning complex regional dynamics into clear, actionable risk indicators, Flashpoint empowers your team to harden defensive postures and mitigate hybrid threats before impact.

Frequently Asked Questions (FAQs)

What is the Flashpoint Physical Threat Intelligence Brief?

The Flashpoint Physical Threat Intelligence Brief: Middle East is a recurring threat intelligence update that translates raw primary-source open-source intelligence (OSINT) and geospatial data into actionable physical security analysis. It focuses on kinetic conflict developments, standoff weapon capabilities, maritime corridor security, and critical infrastructure risks across the Middle East.

How does Flashpoint gather physical security intelligence for the Middle East?

Flashpoint Physical Security Intelligence (PSI) gathers data by combining global open-source intelligence (OSINT), geolocated social media signals, satellite imagery, and primary-source threat monitoring. The platform uses AI-driven natural language processing and geospatial mapping to track kinetic developments, weapon strike radiuses, and physical security threats in real time.

See Flashpoint in Action

Blogs

Blog

Process Parameter Poisoning: Inside a Novel EDR Evasion Technique

In this post, Flashpoint analysts examine Process Parameter Poisoning—a novel EDR evasion technique we validated in Rust—and detail how abusing undocumented process parameters allows attackers to inject code and bypass standard security products.

Modern Endpoint Detection and Response (EDR) platforms have made traditional malware injection techniques significantly harder to execute. In most cases, if a threat actor attempts to write malicious code into a process, an alert will fire. However, that sense of security is being actively challenged as cybercriminals and red teams find new ways to blend malicious payloads into standard operating system routines.

Flashpoint’s Intelligence team built and tested a proof-of-concept for a newly disclosed technique known as Process Parameter Poisoning. By compiling a custom payload and layering evasion mechanics, our analysts demonstrated how easily traditional API hooks can be rendered blind in a laboratory environment—achieving zero alerts across tested EDR/XDR controls.

What is Process Parameter Poisoning?

Process Parameter Poisoning is a novel endpoint detection and response (EDR) evasion technique that combines process parameter spoofing and thread execution hijacking to inject code into foreign processes without triggering standard security detection mechanisms.

Discovered by researchers Max Hirschberger and Ogulcan Ugur, Process Parameter Poisoning is designed to inject code in foreign processes without relying on the conventional memory-manipulation workflows that modern security tooling monitors.

To execute process injection, historically security tools and threat actors alike have focused on a small set of well-known Windows application programming interfaces (APIs). Process Parameter Poisoning shifts away from these heavily watched routines entirely. Instead of calling memory-accessing APIs to allocate and write into a target process, the technique hides the malicious payload directly inside standard process initialization structures during the initial creation of a process. The result is a fundamental shift in defense evasion that effectively blinds traditional, API-hooking EDR agents during the initial stages of code execution.

How Does Process Parameter Poisoning Work?

Process Parameter Poisoning allows attackers to bypass suspicious memory-accessing Windows APIs, such as VirtualAllocEx(), WriteProcessMemory(), and MapViewOfFile2(). Security products heavily monitor these specific APIs due to their high rate of abuse in traditional process injection techniques. However, by avoiding these calls, an attacker effectively bypasses the initial primary triggers used by endpoint agents to flag malicious cross-process memory activity.

When using the Windows application programming interface (API), CreateProcessA/W(), the developer can specify parameters such as the command-line to be executed by the new process, environment variables for the new process, current working directory for the process, window title if it is a console application, create a hidden window, create the process in a suspended state, etc. Many of these parameters are passed into CreateProcessA/W() via the STARTUPINFOA/W structure.

Some entries are undocumented and labeled “reserved” by Microsoft. The discovering researchers found that data stored in STARTUPINFO->lpReserved ends up in the Process Environment Block once the new process is initialized in an entry called “ShellInfo.” Below is an example of placing data into the STARTUPINFOW->lpReserved entry in a test application and the data stored in ShellInfo while debugging the newly created process.

†

Validating Process Parameter Poisoning in Rust

Flashpoint analysts created a proof-of-concept (POC) in Rust to test this technique based on the POC C++ source code provided by the researchers:

1. First the necessary data structures are initialized and the shellcode is passed into the STARTUPINFO->lpReserved field.
2. The target process is created with the infected STARTUPINFO and then a short wait to let the program initialize.
3. NtQueryInformationProcess() is used to acquire PROCESS_BASIC_INFORMATION about the newly created process.
4. The PROCESS_BASIC_INFORMATION structure has an entry called PebBaseAddress that provides the location of the process’s Process Environment Block.
5. NtReadVirtualMemory() is used to read the memory address provided by PebBaseAddress to get the PEB for that process.
6. The PEB has an entry called ProcessParameters that holds the structure RTL_USER_PROCESS_PARAMETERS and is where the ShellInfo entry mentioned earlier is stored.
7. NtReadVirtualMemory() needs to be used again to read the RTL_USER_PROCESS_PARAMETERS structure and get the address of the ShellInfo.Buffer entry.

Flashpoint confirmed that after changing the memory to have executable permissions, the threat actors can perform thread hijacking by using GetThreadContext() to acquire information about the current running thread, change the instruction pointer to point to the ShellInfo.Buffer address, and then SetThreadContext() to apply the changes and execute the shellcode.

Flashpoint analysts further confirm that this technique also works with the WindowTitle entry, CommandLine entry using the same series of steps.

The technique also works with the Environment entry but requires additional steps. Environment blocks require a variable name and the variable data separated by an “=.” Environment blocks can contain multiple variable entries in which each entry is ended with a null terminator. Two null terminators are necessary to denote the end of the environment block. This means the payload needs to be embedded in a longer string with a “{NAME} = {VALUE}” format.

Flashpoint analysts note that four null terminators were appended to the shellcode bytes to denote the end of an environment block in Unicode. The resulting payload buffer is then passed into the lpEnvironment variable of CreateProcessW() along with the CREATE_UNICODE_ENVIRONMENT creation flag.

The rest of the process remains the same as reading the PEB and RTL_USER_PROCESS_PARAMETERS structure. The Environment entry is read, but at the offset of the embedded shellcode within the poisoned environment block string. Because four bytes were added to the beginning of the shellcode to make the Unicode environment block, execution needs to begin after four bytes from the beginning of the buffer to begin executing at the shellcode.

Flashpoint notes that the shellcode requires no NULL bytes, and, if using the PAGE_EXECUTE_READ flag, it cannot overwrite itself. This means automated shellcode generators such as MSFVenom might not work either because they contain NULL bytes or use encoders that perform memory writes during execution. Flashpoint analysts wrote custom shellcode to further test this technique. The shellcode downloads and executes an additional payload. The combination of this technique, custom shellcode, and the use of Rust as the programming language proved successful in minimizing initial static detections by security software.

Flashpoint tested this technique with a commonly-used open source EDR platform. The EDR platform itself failed to produce any alerts from executing the malicious binary. However, the XDR component blocked on the initial creation of a new process and COM interactions by the second stage payload.

Flashpoint analysts then combined this technique with the DLL unhooking technique and applied the non-Microsoft block DLL policy during the creation of the sacrificial process. Analysts observed no blocks from the XDR during execution and observed no alerts on the platform.

Associated MITRE ATT&CK

Tactic	Technique ID	Technique Name
Stealth	T1055	Process Injection
Stealth	T1055.003	Process Injection: Thread Execution Hijacking
Stealth	T1564.010	Hide Artifacts: Process Argument Spoofing

Security teams can leverage several detection strategies to identify Process Parameter Poisoning, though each approach carries distinct limitations:

• Analyzing Parameter Entropy and Argument Spoofing (MITRE ATT&CK T1564.010): Security tools can inspect initialization strings within process structures for unusually high entropy, which often indicates the presence of obfuscated or raw binary shellcode embedded within parameters.
• Monitoring Thread Execution Hijacking (MITRE ATT&CK T1055.003): Analysts can monitor for thread context manipulation; however, because Process Parameter Poisoning does not invoke explicit thread suspension or resumption APIs, specific detection rules that depend on those parameters will fail to trigger.
• Detecting Code Execution in Abnormal Memory Locations (MITRE ATT&CK T1055): Detections can flag execution attempts taking place outside the standard executable section, particularly when code executes directly within Process Environment Block (PEB) parameter buffers.
• Auditing Memory Permission Modifications: Tracking instances where memory region permissions are altered to executable states can reveal payload staging. However, enterprise security controls often tune down or avoid these specific alerts due to high volumes of false positives in normal software operations.

Stay Ahead of Process Parameter Poisoning Using Flashpoint

Process Parameter Poisoning demonstrates another advancement in stealthy process injection and the constantly evolving research into evading security products. By using the previously unknown purpose of the lpReserved field within the STARTUPINFOW structure to house shellcode, this technique bypasses standard security product triggers associated with common memory-allocation APIs. While this proof-of-concept was proven successful in lab testing, the technique has multiple opportunities for detection and will most likely require a combination of additional evasion techniques to achieve a higher success rate.

As threat actors continue to refine technique-stacking and exploit overlooked Windows internals, relying on traditional API hooks is no longer enough to protect your enterprise. Staying ahead of modern evasion mechanics requires proactive intelligence and deep visibility into emerging adversary TTPs.

Request a demo today to see how best-in-class threat intelligence can help security teams detect, prepare for, and neutralize advanced defense evasion techniques before they impact your network.

See Flashpoint in Action

Blogs

Blog

Flashpoint Named A Customer Favorite in The Forrester Wave

In this blog we explore the recently published Forrester Wave: External Threat Intelligence Service Providers, Q3 2026 report which named Flashpoint a Customer Favorite, along with naming the organization a Strong Performer with the highest scores possible in the criteria of: Fraud Intelligence, Executive Protection, and Pricing Flexibility and Transparency.

Flashpoint has been named a Customer Favorite and a Strong Performer in The Forrester Wave: External Threat Intelligence Service Providers, Q3 2026. 

The Forrester Wave evaluation is a rigorous, data-driven analysis of external threat intelligence service providers across 23 criteria grouped into two categories: Current Offering and Strategy. Alongside its scoring, Forrester incorporates direct customer feedback into its evaluation, and the Forrester report notes that customers “laud Flashpoint’s white-glove approach to addressing diverse customer needs.”

“Customer obsession has been part of Flashpoint’s DNA from day one. When your customers are protecting financial systems, critical infrastructure, national security, and human lives, their mission becomes your mission,” said Josh Lefkowitz, CEO at Flashpoint. “Forrester has built this likeminded customer obsession into how it evaluates vendors, and it’s why being named a Customer Favorite means so much to us. We believe it reflects customers confirming Flashpoint gives them the intelligence, context, and partnership they need to carry out those missions with confidence.”

The Primary Source Advantage

Flashpoint also received the highest score possible in three criteria: Fraud Intelligence, Executive Protection, and Pricing Flexibility and Transparency. Forrester’s report describes Flashpoint’s Ignite platform as “stand[ing] out for its fraud intelligence capabilities and strong presence across the ecosystem that supports enterprises’ fraud response.” It further describes Flashpoint’s executive protection offering as “structured and comprehensive.” 

At the foundation of these capabilities is Flashpoint Primary Source Collection, Flashpoint’s proprietary approach to collecting intelligence directly from the digital environments where threats originate — providing organizations with access to high-value intelligence from open and hard-to-reach sources, enriched by human expertise and scaled by AI. We believe Forrester’s assessment speaks directly to this strength, stating that “Flashpoint is ideal for customers seeking primary source access intelligence, particularly those in the financial industry.” That strength extends well beyond financial services. Organizations across industries rely on Flashpoint to address cyber threats, vulnerability risk, fraud, physical security, geopolitical risk, and brand protection.

Purpose Built for the Problems Leading Threat Intel Teams Need to Solve

The remit of threat intelligence programs continues to expand as the volume and complexity of threats grows, accelerated by AI. Now, a single incident can cross cyber operations, fraud, vulnerability management, executive protection, and physical security, while ownership of those risks may sit across several teams. Threat intelligence solutions need to provide holistic visibility into external activity and enough context to determine what deserves attention.

Flashpoint Ignite gives those teams a common intelligence foundation. In our opinion, the Forrester evaluation reflects that breadth: Flashpoint received the highest score possible in both the Fraud Intelligence and Executive Protection criteria.

For fraud teams, primary-source intelligence can expose compromised credentials, illicit services, access sales, and emerging schemes before they translate into financial loss. For executive protection and physical security teams, it can connect online activity with potential real-world risk to people, facilities, and events.

“Flashpoint saves us over $80 million in fraud losses every year. Their proactive approach and sharp insights are crucial in keeping our financial institution secure. They’re not just a solution; they’re a strategic partner helping us stay ahead of cyber threats.”

SVP Cyber Operations, Large U.S. Financial Institution

What Security Leaders Should Look for in a Threat Intelligence Partner

Analyst evaluations give buyers a structured view of a complex market. To understand how a threat intelligence platform will perform in practice, security leaders should ask:

• How close is the intelligence to the source? Understand where the data comes from, whether it is gathered from primary sources or aggregated from third parties and scrapers, how access is maintained, and how much original context is preserved.
• How broadly can the intelligence be applied? Evaluate whether the same foundation can support the risks your organization faces across cyber, vulnerability, fraud, and physical security domains. 
• How does the threat intelligence partner work with customers? Look for breadth and depth of expertise, ability to access analyst insights directly, responsiveness, and the willingness to support complex needs as they emerge.
• Can the program evolve with the organization? The platform and services should accommodate new use cases as intelligence requirements change. In parallel, customers should be able to tailor intelligence gathering for even greater visibility into their specific threat landscape — discovering and adding sources in a fast, automated way from within their workflows.

“I have used Flashpoint for several years and continue to be impressed with the quality of their services and the thought put into each new offering. Flashpoint is one of the few vendors that has consistently demonstrated a high level of responsiveness and an in-depth understanding of the needs of any threat/fraud/security analyst. Their services cover a wide range of topics from cybersecurity to physical threats, and they are always looking for ways to improve and widen the scope of intelligence they provide.”

Lead Analyst, Cybersecurity

Read The Forrester Wave: External Threat Intelligence Service Providers, Q3 2026 to explore the evaluation and learn more about Flashpoint’s results.

Frequently Asked Questions

What is The Forrester Wave: External Threat Intelligence Service Providers, Q3 2026?

The Forrester Wave: External Threat Intelligence Service Providers, Q3 2026 evaluates external threat intelligence service providers across their current offering, strategy, and customer feedback to help security leaders assess vendors in the market.

How did Flashpoint perform in Forrester’s latest evaluation of external threat intelligence service providers?

Flashpoint was named a Customer Favorite and a Strong Performer in The Forrester Wave: External Threat Intelligence Service Providers, Q3 2026. Flashpoint received the highest score possible in the Fraud Intelligence, Executive Protection, and Pricing Flexibility and Transparency criteria.

Why was Flashpoint named a Customer Favorite in the Forrester Wave?

Customer Favorite reflects feedback from customers participating in Forrester’s evaluation. Forrester reported that customers “laud Flashpoint’s white-glove approach to addressing diverse customer needs.” 

What capabilities was Flashpoint recognized for in the Forrester evaluation?

Forrester described Flashpoint Ignite as standing out for its fraud intelligence capabilities and strong presence across the enterprise fraud response ecosystem, while describing its executive protection offering as “structured and comprehensive.”

What differentiates Flashpoint’s threat intelligence?

Flashpoint is built around Primary Source Collection, its proprietary approach to collecting intelligence directly from the digital environments where threats originate. This gives security teams access to intelligence from open and hard-to-reach sources, enriched by human expertise and scaled by AI. In its assessment, Forrester stated that “Flashpoint is ideal for customers seeking primary source access intelligence, particularly those in the financial industry.” That strength extends across sectors: Flashpoint supports more than 750 customers across industries, helping organizations address security challenges spanning cyber threat intelligence, vulnerability management, fraud, physical security, and geopolitical risk.

What security use cases does Flashpoint support?

Flashpoint supports security teams across cyber threat intelligence, vulnerability intelligence, fraud, executive and physical security, geopolitical risk, and brand protection. These capabilities are delivered through Flashpoint Ignite, allowing organizations to apply a common intelligence foundation across multiple security and risk functions.

Forrester Disclaimer

Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester’s objectivity here.

See Flashpoint in Action

Blogs

Blog

How Natural Language Search Powers Rapid Physical Security Intelligence

A look at how natural language processing makes searching and refining results in Echosec simpler.

When physical threats manifest in the real world, every minute counts. Whether tasked with Executive Protection, securing critical infrastructure, or monitoring live events, security teams face a constant challenge: turning massive volumes of noisy online chatter into rapid, actionable insight.

For traditional workflows, surfacing relevant situational awareness required complex Boolean query construction, exhaustive lists of regional keywords, and constant tweaking of syntax. But when an operational threat is unfolding, troubleshooting search logic is the least of your priorities.

In a recent live session, Flashpoint’s Alanah Crocker, Head of the Flashpoint Training Academy, demonstrated a major evolution in Flashpoint’s physical security intelligence capabilities: Natural Language Search and AI-driven Search Planning.

Real-World Impact: Minutes Can Save Lives

When it comes to protecting people and infrastructure, security teams need to know what is happening around them. This involves pulling from mainstream social networks, fringe spaces, regional platforms, and illicit chat channels. By layering in geospatial enrichment and analyst-led finished intelligence, organizations gain the insights they need to function in high-stakes environments.

In this live session Flashpoint showed how analysts no longer need to spend time manually building complex syntax trees. Instead, using Flashpoint’s Physical Security Intelligence, analysts can simply describe what they want to discover in plain language.

• “Recent arson attacks against factories in North America”
• “Traffic disruptions in Central London near VIP transit routes”
• “Situational awareness and security chatter around BC Place Stadium”

With this update, analysts no longer need to spend time manually building complex syntax trees. Here’s what an updated workflow looks like using Flashpoint PSI:

1. Plain Language Prompting: Type your operational question or intelligence focus area into the search bar using everyday language.
2. Automated Search Plan Generation: Flashpoint Ignite instantly analyzes current online chatter, identifies relevant regional keywords, assigns date parameters, and applies precise geospatial boundaries.
3. Human-in-the-Loop Review: Review the proposed search plan, tailor keywords, adjust date ranges, or modify the boundary before execution.
4. Rapid Execution & AI Summarization: Execute the query to receive curated results from global sources alongside an executive summary of key takeaways and sentiment.

How Natural Language Search Accelerates Physical Security Triage and OSINT Workflows

By integrating AI-driven search planning directly into Flashpoint PSI, Flashpoint fundamentally changes how security teams move from initial inquiry to tactical triage. When facing unfamiliar threat vectors, analysts need to eliminate the cold start, so that they are not spending needless time guessing local slangs, hashtags, or regional terms to query. Flashpoint’s natural language processing automates this pre-research phase by synthesizing live open-source chatter to surface active jargon and keywords automatically.

Spatial context is equally seamless. Instead of manually looking up street intersections or plotting coordinates on a map, analysts can simply mention a landmark or venue in plain text. Flashpoint PSI understands the geographical intent, automatically constructing precise spatial geofences around the physical asset, event, or VIP travel routes.

Once populated, intelligence gathering becomes a dynamic conversation rather than a static reporting exercise. Analysts can interrogate their data in real-time, asking Flashpoint to isolate video uploads, filter for explicit threats, or hone in on specific operational themes throughout this workflow—all while ensuring the analyst remains firmly in control throughout the entire workflow.

Protect Critical Assets Using Flashpoint

Want to see for yourself how plain-language prompts can build rich, multi-source intelligence workflows? Request a demo, or check out our Product Update page to explore how AI-driven search planning and relevance ranking accelerates OSINT investigations.

See Flashpoint in Action

Blogs

Blog

Cybercrime at Machine Speed: Key Takeaways from Flashpoint’s 2026 Midyear Threat Intelligence Briefing

Threat actors are no longer just using automation to execute tasks, they are leveraging prepackaged, safeguard-free AI, weaponizing stolen session data, and directly targeting defenders’ security stacks.

In our latest webinar, Flashpoint Vice President of Intelligence, Ian Gray, briefed security leaders on the evolving threat environment, providing critical insights from the Flashpoint Global Threat Intelligence Report (GTIR): 2026 Midyear Edition.

The threat landscape has developed at a striking pace with Flashpoint tracking over 22 million illicit AI discussions, 7.4 million compromised hosts yielding 1.7 billion stolen credentials, and over 21,600 disclosed vulnerabilities in just six months. Beyond these staggering numbers, the on-demand session detailed something even more alarming: a fundamental shift in adversary operational tradecraft.

Here are the five critical shifts every cyber threat intelligence (CTI), Vulnerability Management, and SOC team needs to know.

The Death of Signal: Threat Actors are Shifting to “Private AI”

The public discussion surrounding criminal artificial intelligence (AI) has reached a critical inflection point. Early in the AI boom, Flashpoint observed threat actors collaboratively experiment across underground forums, jailbreaking commercial frontier models or advertising surface-level tools like WormGPT and DarkGPT.

Today, adversaries are shifting from public forums to running fine-tuned, open-source models locally on private servers, which greatly hampers traditional signature-based detection. Flashpoint analysts are now seeing attackers generate unique, highly tailored malware variants, flawless phishing lures, and custom exploit scripts at extremely low costs—completely offline and shielded from public monitoring.

“A few months ago, a lot of this was collaborative… public outsourcing. Now what we’re seeing is scarier: pre-packaged cybercrime models run locally on private infrastructure. Malicious code, exploit scripts, and targeted phishing are all being generated inside closed environments.”

Ian Gray, VP of Intelligence, Flashpoint

Weaponizing the Defender’s Own Tooling

Another eye-opening tactical insight shared during the session was how threat actors are repurposing defender infrastructure for automated initial access and extortion. In the webinar, we pointed to recent campaigns where adversaries specifically targeted misconfigurations and zero-day vulnerabilities inside open-source vulnerability scanners, secrets-detection tools, Kubernetes clusters, and Infrastructure-as-Code(IaC) environments.

What this means for defenders is that the attack surface is no longer bounded by traditional enterprise network boundaries: it extends directly into CI/CD pipelines, security orchestration tooling, and third-party SaaS integrations. Security teams are finding themselves in a race against attackers who use automated scanning scripts to weaponize vulnerabilities in the security tools themselves.

The Global Infostealer Threat and Identity-First Attacks

Flashpoint tracked 7.4 million hosts compromised by infostealers in H1 2026—a 27% increase period-over-period—harvesting 1.7 billion credentials and identity information.

While the top infostealer strains remain familiar, law enforcement operations have created vacuums that competitors rapidly fill.

Threat actors are leveraging drive-by downloads, watering holes, and pirated software packages to plant stealers. Once a machine is compromised, the logs capture corporate SSO credentials, active browser cookies, VPN keys, and SaaS session tokens. This enables adversaries to simply log in without having to leverage complex technical exploits.

The Structural Failure of CVE/NVD and the Importance of KEV

The Common Vulnerabilities and Exposures (CVE) and National Vulnerability Database (NVD) have failed to keep pace with the velocity of AI-assisted vulnerability discovery. As such, vulnerability management teams are facing significant operational delays.

Metric	Flashpoint GTIR Midyear H1 2026 Data	Operational Impact
Total Disclosures	21,667	Remediation volume exceeds defender bandwidth.
Exploit Availability	19% (4,015 CVEs)	Functional code is ready before patches are deployed.
Public Catalog Lag	Growing Backlog (NVD/KEV)	Delay in official scoring leaves teams blind to active risk.

Therefore, waiting for NVD enrichment before prioritizing a patch is a dangerous strategy. To compensate, security teams require Vulnerability Intelligence (VI) that provides primary-source confirmation of weaponization, exploit availability, and actionable mitigation guidance long before public databases update.

Ransomware Evolution: From Encryption to Cloud Extortion

Ransomware-as-a-Service (RaaS) activity surged by 45% period-over-period, reaching 6,256 verified victim postings on data leak sites. However, total on-chain payout revenue dropped by 8% to $820 million, with victim pay-rates hitting a record low of 28%.

Faced with declining payouts and resilient enterprise backups, extortion syndicates are adapting. Rather than relying exclusively on technical file-encrypting malware, groups are executing pure data extortion campaigns—frequently targeting cloud platforms or extracting data through third-party vendor access.

Protect Your Organization Using Flashpoint

Defending against machine-speed attacks requires moving beyond reactive, post-incident telemetry. Flashpoint arms security, CTI, and vulnerability management teams with the primary-source intelligence required to preempt adversary operations:

• Unrivaled Deep & Dark Web Visibility: Flashpoint’s Primary Source Collection actively monitors closed criminal communities, illicit Telegram channels, and private forums, giving you early warning when threat actors build custom AI toolkits or trade credentials targeting your organization.
• Comprehensive Vulnerability Intelligence (VI): Flashpoint tracks zero-days and vulnerability disclosures independently, delivering immediate exploit availability data and threat-informed prioritization so you patch what actually matters.
• Continuous Compromised Credential Monitoring: Instantly surface exposed enterprise credentials, active session tokens, and stealer logs tied to your domain or third-party supply chain before they lead to an account takeover (ATO).

Request a demo, or watch the full on-demand webinar to explore the data shaping today’s risk landscape.

See Flashpoint in Action