Lucie Cardiet

As John Watts, the Gartner VP Analyst presenting the ThreatScape, put it: cybersecurity leaders must be able to find the threat signal in all the noise. This piece is one read of that signal.

TeamPCP collected 500,000+ cloud credentials from CI/CD pipelines before anyone was targeted. VECT used that archive to select ransomware victims. Why your exposure may already be determined.

An FBI complaint against a Scattered Spider member documents a full help-desk attack: vishing, an MFA reset, ngrok exfiltration, and why authentication succeeded at every step.

FortiBleed exposed valid logins for 86,644 Fortinet firewalls. No CVE, nothing to patch. Why a working login slips past prevention, and where to catch it.

Four signed drivers. Three had documented CVEs. None on the blocklist. How DragonForce used the kernel signing pipeline to disable security tools.

A year of AI-enabled attacker activity, what it tells us about where attacks are headed, and where detection holds up.

Conti to The Gentlemen: four ransomware leaks, four years. The operators evolved. The gaps stayed exactly where they were. What CISOs should do next.

TeamPCP open-sourced Shai-Hulud today. The OIDC token extraction technique that made the TanStack attack different from every previous campaign is now a public toolkit.

ShinyHunters isn't a single group. It's a pattern of attacks where authentication succeeds. Here's how to detect them before the data warehouse.

Attackers bypass MFA using non-interactive sign-ins. Learn how to detect and stop credential-based threats before they escalate.

Another supply-chain breach hit SaaS in April 2026 — Anodot tokens used to access Snowflake. Why the same ShinyHunters-branded pattern keeps repeating, and what makes the MO hard to detect.

Compromise of endpoint management systems changes the attack path entirely. Learn how control-plane attacks bypass early detection and why behavior across identity, network, and endpoints is the only reliable signal.

A compromised npm package is only the entry point. The axios incident shows how quickly attackers pivot from code execution to credential abuse, identity misuse, and cloud access.

Detect how Sliver C2 evades traditional beacon detection and how behavioral AI identifies command-and-control activity hidden in encrypted traffic.

Prompt control turns AI agents into command-and-control systems by manipulating context, memory, and inputs—enabling persistent, stealthy attacker control through normal agent behavior.

Learn how attackers move laterally across hybrid networks, abusing identity, credentials, and legitimate tools to reach critical systems before launching ransomware or stealing data.

Learn how attackers maintain hidden access inside hybrid networks and how SOC teams can detect persistence before it leads to data theft or ransomware.

Inside the Stryker incident: how Handala likely moved from identity access to disruption, and the identity, scripting, and data transfer signals SOC teams should watch.

Detect Iranian APT activity across identity and network telemetry with six practical threat hunts. Run ready-to-use queries in the Vectra AI Platform to uncover credential abuse, C2 infrastructure, and early compromise signals.

Molt Road reveals how attacker marketplaces could evolve when autonomous agents trade services, coordinate attacks, and remove humans from the loop.

Moltbook exposes how autonomous AI agents turn trust and interaction into attack paths, enabling prompt injection, lateral movement, and covert command and control.

Clawdbot – now Moltbot – shows how autonomous AI agents become shadow superusers, enabling initial access, lateral movement, and ransomware when trust is abused.

Threat actors try to stay invisible, but OPSEC mistakes keep exposing them. A look at real-world failures and what they reveal about human error and AI-driven attacks.

Pro-Russia hacktivists are disrupting critical infrastructure by abusing legitimate access. Learn how these OT attacks work and why traditional tools miss them.

How the Shai-Hulud worm hijacked trusted development tools and why defenders need behavioral visibility to catch the attack after the first package is installed.

Chinese state-backed Typhoon APTs infiltrate networks using trusted tools. Learn how the Vectra AI Platform detects their stealthy, persistent behavior.

Europol seized 1,000+ servers and €21M across three phases targeting initial access brokers. Criminal groups rebuilt within days — static defenses cannot keep up.

Learn how attackers gain initial access to your hybrid network, and how to stop intrusions before they turn into breaches.

From Conti to Black Basta to DevMan, ransomware code keeps resurfacing. See how behavioral AI detects the attacker behaviors that rebrands cannot hide.

The F5 compromise shows how attackers abuse trusted edge systems. Behavioral detection spots hidden persistence where perimeter tools fail.

Qilin’s 2025 variants use MFA bombing, SIM swapping, and AES-256-CTR encryption to evade detection. Discover how the Vectra AI Platform exposes their behavior before encryption starts.

Crimson Collective says defenders only “map the coastline.” See how Vectra AI dives deeper, turning cloud and identity telemetry into real-time detection of hidden threats.

The Cl0p ransomware group’s link to the Oracle EBS exploit sparks debate. Learn how supply chain attacks evolve and what defenders must do next.

The Crimson Collective claims to have stolen Red Hat consulting data, exposing customer engagement reports. Learn why consulting artifacts are prime attacker targets and how Vectra AI helps close the gap.

Patching stops entry, but not attacker behavior. See how detection closes the post-exploitation gap

Discover how BRICKSTORM hid for 400 days in enterprise blind spots and learn how Vectra AI closes detection gaps across network, identity, and cloud.

Scattered Lapsus$ Hunters may claim they’re gone, but The Com endures. Cybercrime has moved beyond ransomware into an era where extortion is the goal.

LockBit is back with version 5.0. Discover its new features, TTPs, and how SOC teams can detect attacks where prevention alone falls short.

Poisoned npm packages are just the entry point. Discover how attackers move next and why SOC teams must detect behaviors beyond the initial exploit.

AI is accelerating cybercrime — from ransomware kits to insider fraud. Learn how attackers exploit security gaps and how Vectra AI helps you detect what others miss.

Hunt for risky multi-tenant apps in Microsoft 365. Learn how attackers exploit consent-based access and how to detect misconfigurations in minutes.

Discover how GLOBAL RaaS empowers affiliates with enterprise-scale ransomware features, and how Vectra AI detects threats others miss.

Nation-state campaigns bypass prevention controls. Learn why post-compromise detection is now critical

Discover how Scattered Spider, Volt Typhoon, Mango Sandstorm, and UNC3886 evaded defenses - and why SOC teams need NDR to stop them in time.

Modern attacks often begin with valid credentials and evade detection. Learn what questions to ask vendors about post-compromise visibility.

Critical SharePoint flaws CVE-2025-53770 and CVE-2025-53771 are under active attack. Learn what’s happening and how Vectra AI detects and stops it.

Iranian groups exploit identity and cloud trust relationships. Understand their tactics and how to detect them early

Attackers aren't breaking your tools: they're slipping between them. Learn where your stack is blind and how to finally close the security gap.

Ransomware groups like Black Basta are using OSINT to profile targets and exploit public data. Learn how attackers gather intel, and how you can reduce your digital footprint.

AI is now the target. Learn how attackers exploit GenAI like Copilot, and how frameworks like MITRE ATLAS, OWASP for LLM apps and AI Risk Repository help you detect what others miss.

Play ransomware is evolving fast. Learn how new tactics evade legacy tools and how Vectra AI delivers the coverage, clarity, and control to stop it.

Learn how threat actors are abusing Brute Ratel (BRC4): a red teaming and adversary simulation tool to evade your defenses and how to detect it.

CISA’s latest advisory warns about fast flux, a technique attackers use to evade detection. Learn how Vectra AI’s behavioral analytics detect and stop it.

Learn how attackers use metadata search engines like Shodan and FOFA to identify vulnerable systems and build lists of targets.

Safeguard your federal network from state-sponsored APTs and internal vulnerabilities with advanced NDR with purpose-built AI.

Attackers abuse EV certificates to sign malware and evade detection. Learn how they steal, use, and automate trusted code signing for ransomware.

A concise, real-world case study showcasing agile incident response and tailored threat detection for the modern network.

Ghost ransomware exploits known CVEs to encrypt data within hours of access. Learn which behaviors signal an active Ghost intrusion.

Learn how to detect and mitigate ransomware attacks targeting AWS S3 buckets. Discover best practices and how Vectra AI can help secure your cloud.

Microsegmentation limits spread, but doesn’t detect it. See where it fails and how detection closes the gap.

Learn how attackers exploit the NTLM zero-day vulnerability and how Vectra AI can protect your organization from credential theft.

Salt Typhoon targets global telcos. Learn how improved visibility, hardening, and Vectra AI help defend against these advanced threats.

Discover why traditional defenses fall short and how continuous offensive security testing can help your organization detect and respond to cyber attacks.

Zero-day attacks on edge devices bypass prevention entirely. Learn how NDR detects post-compromise behavior before attackers escalate

Protect yourself this holiday season from malicious websites. Learn how hackers deceive shoppers and how to stay secure online.

Planning to attend a cybersecurity event? Stay secure with these 19 essential tips to protect yourself from getting hacked

SIM swapping and phishing proxies bypass SMS MFA. See how attackers exploit it and which alternatives reduce risk