A threat group tracked as UNC6692 uses social engineering to deploy a new, custom malware suite named 'Snow' which includes a ...

UNC6692 has been attributed to a large email campaign that's designed to overwhelm a target's inbox with a flood of spam ...

A cyber group is impersonating IT helpdesk staff via Microsoft Teams to deploy malware and target corporate systems.

PowMix targets Czech workforce since Dec 2025 using jittered C2 and ZIP phishing, enabling stealthy remote access and ...

PowerShell's scripting language and ability to interact directly with Windows system elements give it a superpower that Command Prompt lacks.

Threat actors are abusing external Microsoft Teams collaboration to impersonate IT helpdesk staff and convince users to grant ...

CERT-UA links the AgingFly credential-stealing campaign to phishing, browser theft, and modular remote access.

Google Antigravity’s increasing popularity has brought the development platform into the crosshairs of researchers and ...

Microsoft is warning of threat actors increasingly abusing external Microsoft Teams collaboration and relying on legitimate ...

Popular tool abuse, ClickFix, and identity-based attacks are among the most prevalent techniques bad actors are deploying ...

Microsoft warns of rising Teams attacks abusing external chats to impersonate IT staff, gain remote access, and steal ...

TL;DR  Introduction   In my previous blog post, I wrote about finding your path into DFIR; how to get started, where to focus ...