Threat Intelligence

One N-central console can manage thousands of endpoints across dozens of client businesses. That is the arithmetic that makes the recent N-able emergency so dangerous. Take the console, and you inherit the ability to act…

Simon White, Incident Response Analyst
September 23, 2026 3 Min Read

Jamf Threat Labs has documented AmnesiaStealer, a multi-stage Rust-based macOS infostealer distributed through ClickFix. A counterfeit GitHu...

Simon White, Incident Response Analyst
September 21, 2026 2 Min Read

ShinyHunters claimed on 27 July that it had stolen 623 GB from the cloud communications platform. The Register reported how: the group voice...

Simon White, Incident Response Analyst
September 19, 2026 2 Min Read
Subscribe Via Email

March 24, 10:39 UTC. The first poisoned LiteLLM package landed on PyPI two minutes earlier, and on some CI runner somewhere, the credential harvest had already started. Nobody outside the attacker noticed for hours. That…

Simon White, Incident Response Analyst
August 19, 2026 4 Min Read

Howard University never signed up to be a proxy provider. But for months, anyone with five dollars in crypto and a burner email address could route their internet traffic through the university’s entire /16 IP…

Simon White, Incident Response Analyst
August 14, 2026 5 Min Read

On July 26 and 27, 2026, a coordinated cyberattack hit operational technology (OT) systems at more than 30 community water and wastewater utilities across Minnesota. Attackers disrupted automated control functions, forcing some plants to switch…

Simon White, Incident Response Analyst
August 4, 2026 4 Min Read

OpenAI put two of its most advanced models inside a locked room to test how well they could hack. The models picked the lock, opened the doo...

Ella Ballard, Product Marketing Manager
July 31, 2026 3 Min Read

On July 28, 2026, JFrog confirmed what the security industry had been speculating about for a week, the package-registry proxy that OpenAI&...

Simon White, Incident Response Analyst
July 26, 2026 5 Min Read

Something we track in the Adversary Operations Group is residential proxy networks. Infoblox uncovered an operation they call Lurking Lizard...

Simon White, Incident Response Analyst
July 20, 2026 2 Min Read

Someone pretending to be an Adidas recruiter sent me a meeting invitation last week. At least, that is what the email looked like. The branding was right.   The recruiter’s name was real. The company logo…

Simon White, Incident Response Analyst
July 18, 2026 2 Min Read

Microsoft released an emergency patch on July 9, 2026, for a Microsoft Defender zero-day vulnerability dubbed “RoguePlanet” (CVE-2026-50656) that allows attackers to gain SYSTEM privileges on fully patched Windows 10 and Windows 11 devices (BleepingComputer,…

Simon White, Incident Response Analyst
July 16, 2026 < 1 Min Read