powershell.exe

• Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite

  Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite Written by: JP Glab, Tufail Ahmed, Josh Kelley, Muhammad Umair Introduction Google Threat Intelligence Group (GTIG) identified a multistage intrusion campaign by a newly tracked threat group,

• North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack

  North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack Written by: Austin Larsen, Dima Lenz, Adrian Hernandez, Tyler McLellan, Christopher Gardner, Ashley Zaya, Michael Rudden, Mon Liclican, Muhammad Umair Introduction Google Threat Intel

• Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape

  Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape Written by: Bavi Sadayappan, Zach Riddle, Ioana Teaca, Kimberly Goody, Genevieve Stark Introduction Since 2018, when many financially motivated threat actors began shifting their moneti

• When prompts become shells: RCE vulnerabilities in AI agent frameworks

  When prompts become shells: RCE vulnerabilities in AI agent frameworks New research exposes how prompt injection in AI agent frameworks can lead to remote code execution. Learn how these vulnerabilities work, what’s impacted, and how to secure your agents. The post When prompts

• DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

  DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy Key Points The Gentlemen RaaS The Gentlemen ransomware‑as‑a‑service (RaaS) operation is a relatively new group that emerged around mid‑2025. The operators advertise their services across multiple underground f

• From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities

All reports →