Attack Profile

Surface: Web Application (Mjobtime)

Phases: Initial Access, Lateral Movement, Command Execution

MITRE: Initial Access, Execution, Persistence T1189 (Blind SQL Injection), T1059.001 (Command and Scripting Interpreter: PowerShell)

Actors and Tooling

Threat Actors: Unknown

Malware/Tools: sqlservr.exe, xp_cmdshell

Campaign: Unknown

Business Impact

Why it matters: Construction companies often rely on specialized software for managing operations. Exploiting vulnerabilities in these applications can compromise critical data and systems.

Owner team: Not specified

Attack Profile

Surface: User Execution of LNK files

Phases: Initial Infection, Payload Delivery, System Compromise

MITRE: Initial Access, Execution, Persistence, Defense Evasion, Collection, Command and Control T1566.001 - Phishing, T1204.002 - Obfuscated Files or Information, T1059.001 - Command and Scripting Interpreter: PowerShell, T1078 - Valid Accounts

Actors and Tooling

Threat Actors: Unknown

Malware/Tools: Amnesia RAT, Microsoft Defender

Campaign: N/A

Business Impact

Why it matters: Widespread file encryption, stolen data, abuse of Defendnot to disable Microsoft Defender.

Owner team: N/A

Attack Profile

Surface: Web Browsers

Phases: Delivery, Execution

MITRE: Execution

Actors and Tooling

Threat Actors:

Malware/Tools: LogoKit

Campaign:

Business Impact

Why it matters: This technique allows attackers to evade network analysis, increase the diversity of malicious scripts, and tailor phishing campaigns.

Owner team:

Attack Profile

Surface: Azure Private Link, DNS resolution

Phases: Reconnaissance, Denial of Service

MITRE: Denial of Service

Actors and Tooling

Threat Actors:

Malware/Tools:

Campaign:

Business Impact

Why it matters: Denial of service to storage accounts can cause Azure Functions to fail, and DoS to Key Vaults can disrupt dependent processes.

Owner team:

Attack Profile

Surface:

Phases:

MITRE:

Actors and Tooling

Threat Actors:

Malware/Tools:

Campaign:

Business Impact

Why it matters:

Owner team:

Attack Profile

Surface: Email (Spear Phishing)

Phases: Initial Infection, Lateral Movement, Command and Control

MITRE: Initial Access, Execution, Command and Control T1566.001 (Phishing), T1204.002 (User Execution via Malicious File), T1059.001 (Command and Scripting Interpreter – PowerShell), T1047 (Windows Management Instrumentation)

Actors and Tooling

Threat Actors: UNG0902

Malware/Tools: DUPERUNNER, AdaptixC2, PowerShell

Campaign: Operation DupeHike

Business Impact

Why it matters: Targets critical departments (HR, payroll) within Russian organizations, potentially leading to data breaches and financial fraud.

Owner team:

Attack Profile

Surface: Email

Phases: Initial Access, Execution, Persistence

MITRE: Initial Access, Execution, Persistence; Initial Access, Persistence, Execution, Exfiltration; Initial Access, Persistence, Command and Control T1566.001 (Phishing: Spearphishing Attachment), T1204.002 (User Execution: Malicious File); T1566.001 (Phishing: Spearphishing Attachment), T1059.003 (Command and Scripting Interpreter: PowerShell), T1053.001 (Scheduled Task/Job: Scheduled Task); T1566.001 (Phishing), T1547.001 (Boot or Logon Autostart Execution), T1059.003 (Scheduled Task/Job: Post-Scheduling)

Actors and Tooling

Threat Actors: Unknown; KONNI

Malware/Tools: Rust-based RAT, PowerShell, Batch scripts; FALSECUB; PowerShell Backdoor, OneDriveUpdater.exe

Campaign: Operation Covert Access

Business Impact

Why it matters: Targets sensitive legal and institutional data within the judicial sector.

Owner team:

Attack Profile

Surface: Unknown

Phases: Unknown

MITRE:

Actors and Tooling

Threat Actors: Single individual

Malware/Tools: VoidLink, TRAE SOLO, TRAE

Campaign: VoidLink

Business Impact

Why it matters: Highlights the dangers of AI in malware development, normalizing high-complexity attacks previously associated with high-resource threat actors.

Owner team:

Attack Profile

Surface: Customer data platforms, IT systems, servers, email platforms, third-party vendors, WordPress plugins, Bluetooth accessories, Microsoft Desktop Window Manager

Phases: Initial Access, Exploitation, Lateral Movement, Data Exfiltration

MITRE: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Data Encrypted for Impact, Command and Control Spearphishing Attachment (T1566.001), Exploit Public-Facing Application (T1190), Credential Theft (T1003), Data Encrypted for Impact (T1486), Command and Control

Actors and Tooling

Threat Actors: Unknown, China-affiliated, Possibly Russian-linked (Sicarii ransomware)

Malware/Tools: Ransomware, Sicarii, VoidLink

Campaign: N/A

Business Impact

Why it matters: These attacks highlight the continued risk of data breaches, ransomware, and social engineering. The exploitation of vulnerabilities like CVE-2025-37164 and CVE-2026-20805 requires immediate attention. The wide range of targeted organizations demonstrates the broad threat landscape.

Owner team: N/A

Attack Profile

Surface: Endpoint, Networks

Phases:

MITRE:

Actors and Tooling

Threat Actors: Qilin Ransomware, r1z

Malware/Tools: Qilin Ransomware

Campaign:

Business Impact

Why it matters: Highlights ongoing ransomware activity, particularly targeting specific industries and geographic regions, and exposes access broker activity.

Owner team:

Attack Profile

Surface: Networks, EndPoint

Phases:

MITRE:

Actors and Tooling

Threat Actors: INC Ransom, BreachLaboratory

Malware/Tools: INCRansom

Campaign:

Business Impact

Why it matters: Significant data breaches affecting major financial institutions pose a systemic risk to national financial systems and require proactive measures.

Owner team:

Attack Profile

Surface: Software Download Portals, Task Scheduler, DLL side-loading

Phases: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion

MITRE: Defense Evasion, Execution, Persistence T1059.003 - Task Scheduler, T1027 - Obfuscated Files or Information, T1202 - Indirect Command Execution

Actors and Tooling

Threat Actors: Larva-25012

Malware/Tools: Proxyware (DigitalPulse, Honeygain, Infatica), DPLoader, Notepad++

Campaign:

Business Impact

Why it matters: Proxyware hijacks user bandwidth for malicious purposes, impacting performance and potentially exposing users to further attacks.

Owner team:

Attack Profile

Surface: Remote Work Infrastructure, Hiring Platforms

Phases: Initial Access, Exploitation, Persistence

MITRE: Initial Access Social Engineering (T1566), Impersonation (T1098)

Actors and Tooling

Threat Actors: Famous Chollima

Malware/Tools: AnyDesk, Google Remote Desktop, Astrill VPN, Simplify Copilot, AIApply, Final Round AI

Campaign:

Business Impact

Why it matters: Highlights a growing trend of APT groups using fake job opportunities to gain access to critical systems and data.

Owner team:

Attack Profile

Surface:

Phases:

MITRE:

Actors and Tooling

Threat Actors: Hacktivists

Malware/Tools:

Campaign:

Business Impact

Why it matters:

Owner team:

Attack Profile

Surface: Internal systems

Phases: Initial Access, Data Exfiltration

MITRE: Exfiltration

Actors and Tooling

Threat Actors: iProfessor; aming

Malware/Tools:

Campaign:

Business Impact

Why it matters: Exposure of sensitive patient medical information could lead to identity theft, fraud, and reputational damage.

Owner team:

Attack Profile

Surface: Web-based management interface

Phases: Initial Access, Exploitation

MITRE: Initial Access T1189 - Drive-by Compromise

Actors and Tooling

Threat Actors:

Malware/Tools:

Campaign:

Business Impact

Why it matters: The vulnerability allows privilege escalation to root, potentially giving attackers full control of affected devices.

Owner team:

Attack Profile

Surface: POS platform

Phases:

MITRE:

Actors and Tooling

Threat Actors: 888

Malware/Tools:

Campaign:

Business Impact

Why it matters: Exposure of sensitive customer data including addresses, phone numbers, and potentially financial information from a POS system.

Owner team:

Attack Profile

Surface: Exploit Forum

Phases: Initial Access, Data Exfiltration

MITRE: Collection

Actors and Tooling

Threat Actors: SinCity

Malware/Tools:

Campaign:

Business Impact

Why it matters: The sale of driver license images enables identity theft and fraud. The actor's history suggests a broader pattern of selling illicit credentials and materials.

Owner team:

Attack Profile

Surface: Customer Database

Phases:

MITRE:

Actors and Tooling

Threat Actors: daghetiaw

Malware/Tools:

Campaign:

Business Impact

Why it matters: The breach exposes sensitive customer data, including financial information, potentially leading to identity theft and financial fraud.

Owner team:

Attack Profile

Surface:

Phases:

MITRE:

Actors and Tooling

Threat Actors:

Malware/Tools:

Campaign:

Business Impact

Why it matters:

Owner team:

Attack Profile

Surface: Internal Systems

Phases: Initial Access, Exploitation

MITRE: Initial Access

Actors and Tooling

Threat Actors: darrk07x (TEAM DARK 07X), JOKEIR 07X, DR SHELL 08X

Malware/Tools:

Campaign:

Business Impact

Why it matters: Exposure of citizen data and insurance documents poses a risk of identity theft and financial fraud.

Owner team:

Attack Profile

Surface: acuity.com

Phases:

MITRE:

Actors and Tooling

Threat Actors: Solonik

Malware/Tools:

Campaign:

Business Impact

Why it matters: Exposure of sensitive customer data including PII and financial information. Potential for identity theft, fraud, and targeted attacks.

Owner team:

Attack Profile

Surface: Online Forum Database

Phases: Initial Access, Data Collection, Exfiltration

MITRE: Collection Data Encapsulation (T1005), Exfiltration Over C2 Channel (T1041)

Actors and Tooling

Threat Actors: 0BITS

Malware/Tools: N/A

Campaign: ANTIFA Database Leak

Business Impact

Why it matters: The leaked data could be used for doxing, identity theft, and harassment of individuals associated with Fascist Forge. It also reveals the inner workings and communication of a network of white supremacists and accelerationist groups.

Owner team: N/A

Attack Profile

Surface:

Phases:

MITRE:

Actors and Tooling

Threat Actors:

Malware/Tools:

Campaign:

Business Impact

Why it matters:

Owner team:

Attack Profile

Surface: Mobile Devices (Phones)

Phases: Weaponization, Delivery, Exploitation, Action on Objectives

MITRE: Initial Access, Execution, Collection T1056.001 - Native API (Pegasus)

Actors and Tooling

Threat Actors: NSO Group, Israeli Government

Malware/Tools: Pegasus

Campaign:

Business Impact

Why it matters: Highlights the potential for state-sponsored cyber-espionage and the challenges of international cooperation in investigations involving spyware technologies. Demonstrates the impact on government officials and civil society.

Owner team:

Attack Profile

Surface: Mobile Devices (iOS & Android)

Phases: Data Extraction, Forensics

MITRE: Collection T1005 - Data from Local System

Actors and Tooling

Threat Actors: Government of Jordan

Malware/Tools: Cellebrite

Campaign:

Business Impact

Why it matters: Demonstrates abuse of digital forensics tools against civil society and human rights defenders.

Owner team:

Attack Profile

Surface: Mobile networks, SMS

Phases: Initial Access, Execution, Persistence, Collection, Exfiltration

MITRE: Initial Access, Collection, Command and Control T1189 - Drive-by Compromise, T1005 - Input Capture, T1071.001 - System Information Discovery

Actors and Tooling

Threat Actors: Chinese nationals (reportedly)

Malware/Tools: SMS blaster, DC-to-AC power converter (NFA)

Campaign: N/A

Business Impact

Why it matters: This operation demonstrates a sophisticated and rapidly deployable scamming technique that exploits vulnerabilities in mobile networks to steal sensitive information and commit fraud.

Owner team: N/A