Emerging Threats

Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking

Emerging Threats, News /

Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking 2026-08-19 at 18:40 By Serhii Melnyk and Timmy Lister Following GreenPlasma, YellowKey and MiniPlasma, RoguePlanet and GreatXML, and LegacyHive, the Nightmare-Eclipse disclosure actor has published ShieldBreak — its latest Windows proof of concept (PoC) released shortly after Microsoft’s August 2026 Patch Tuesday. […]

Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking Read More »

Beyond the Inbox: How BEC Leads to SSO Abuse

email security, Emerging Threats, Vulnerabilities /

Beyond the Inbox: How BEC Leads to SSO Abuse 2026-08-13 at 20:40 By Jamie Mamroe and Federico Cedolini For years, many business email compromise (BEC) investigations have followed a familiar playbook: an attacker phishes credentials, logs into the victim’s mailbox, establishes persistence with inbox rules, monitors communications, and waits for an opportunity to steal money

Beyond the Inbox: How BEC Leads to SSO Abuse Read More »

The Infrastructure Relay: Inside Multi-Stage Phishing Redirection Chains

email security, Emerging Threats /

The Infrastructure Relay: Inside Multi-Stage Phishing Redirection Chains 2026-08-12 at 16:42 By Karla Agregado To stay ahead of evolving threats, LevelBlue utilizes a machine-learning-based URL scanner that constantly evaluates the digital landscape. We closely monitor VirusTotal for instances where LevelBlue acts as the sole detection layer — a crucial tactic for spotting new phishing campaigns

The Infrastructure Relay: Inside Multi-Stage Phishing Redirection Chains Read More »

Practical Cybersecurity for Small Water Utilities: 5 Steps to Reduce Operational Risk

Emerging Threats, News, Tips & Tricks /

Practical Cybersecurity for Small Water Utilities: 5 Steps to Reduce Operational Risk 2026-08-11 at 17:00 By Nolen Johnson Recent cyberattacks against U.S. water and wastewater systems delivered an important reminder: disrupting operational technology (OT) does not always require sophisticated malware or a previously unknown vulnerability. In the July 2026 activity, internet-facing programmable logic controllers (PLCs),

Practical Cybersecurity for Small Water Utilities: 5 Steps to Reduce Operational Risk Read More »

Beyond ‘Fake Updates’: From Application Store-Themed Phishing to Large-Scale Distribution of ScreenConnect

Emerging Threats, Vulnerabilities /

Beyond ‘Fake Updates’: From Application Store-Themed Phishing to Large-Scale Distribution of ScreenConnect 2026-08-07 at 16:10 By King Orande and Cris Tomboc The LevelBlue OpsCTI Team recently identified a large-scale phishing campaign leveraging a new social engineering method to deploy unauthorized ConnectWise ScreenConnect clients. Rather than relying on conventional phishing pages, the campaign recreates convincing software

Beyond ‘Fake Updates’: From Application Store-Themed Phishing to Large-Scale Distribution of ScreenConnect Read More »

Review of the July 2026 Cyberattacks Against U.S. Water and Wastewater Systems

Emerging Threats, News, Security Research /

Review of the July 2026 Cyberattacks Against U.S. Water and Wastewater Systems 2026-08-04 at 16:20 By Nikita Kazymirskyi In light of the water-sector activity described below, we’ve increased monitoring for related indicators of compromise across our client environments. Please contact your LevelBlue account team with questions specific to your environment. This article is an excerpt

Review of the July 2026 Cyberattacks Against U.S. Water and Wastewater Systems Read More »

LevelBlue TTP Briefing Q2 2026: Stolen Identities Outpace Defenses

DFIR, Emerging Threats, Reports /

LevelBlue TTP Briefing Q2 2026: Stolen Identities Outpace Defenses 2026-07-23 at 17:00 By Explore the latest tactics, techniques, and procedures (TTPs) our incident response (IR) experts are actively facing in the quarterly TTP Briefing, a report built on frontline threat intelligence from our global incident response investigations across LevelBlue during Q2 2026. This article is

LevelBlue TTP Briefing Q2 2026: Stolen Identities Outpace Defenses Read More »

LegacyHive: Nightmare-Eclipse’s Latest Zero-Day Drop with a Stripped PoC

Emerging Threats, Vulnerabilities /

LegacyHive: Nightmare-Eclipse’s Latest Zero-Day Drop with a Stripped PoC 2026-07-20 at 15:35 By Pauline Bolaños Vexed researcher Nightmare-Eclipse (aka Chaotic Eclipse, Dead Eclipse, and MSNightmare) released his ninth unpatched Windows vulnerability called LegacyHive. This latest bug drop is a Local Privilege Escalation (LPE) vulnerability affecting Windows User Profile, a component responsible for loading and unloading

LegacyHive: Nightmare-Eclipse’s Latest Zero-Day Drop with a Stripped PoC Read More »

Still Circling: Blind Eagle’s Toolkit Keeps Evolving

Emerging Threats, Threat Intelligence /

Still Circling: Blind Eagle’s Toolkit Keeps Evolving 2026-07-17 at 16:57 By Serhii Melnyk In June 2025, LevelBlue SpiderLabs published Tracing Blind Eagle to Proton66, in which we assessed with high confidence that Blind Eagle (also tracked as APT-C-36, APT-Q-98, TAG-144, AguilaCiega), a threat actor focused on Latin America, had moved part of its VBScript delivery

Still Circling: Blind Eagle’s Toolkit Keeps Evolving Read More »

ClickFix on macOS: Blockchain-Powered Infostealer Hidden Inside Compromised Websites

Emerging Threats, Threat Intelligence, Vulnerabilities /

ClickFix on macOS: Blockchain-Powered Infostealer Hidden Inside Compromised Websites 2026-07-16 at 16:43 By Rodel Mendrez You’re browsing a legitimate small business website. Before the page loads, a familiar Cloudflare box appears: “Verify you are human.” It asks you to open Terminal, paste a code, and press Enter. You’ve seen this before. You follow the steps.

ClickFix on macOS: Blockchain-Powered Infostealer Hidden Inside Compromised Websites Read More »

Hiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.JS Backdoor

Emerging Threats, Threat Intelligence, Vulnerabilities /

Hiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.JS Backdoor 2026-07-10 at 23:49 By Nathaniel Morales The LevelBlue Managed Threat Research team investigated a security alert in a customer environment involving a malicious ZIP file containing a Windows shortcut (.lnk) used for initial execution. When triggered, the LNK file executes a

Hiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.JS Backdoor Read More »

Hiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.JS Backdoor

Emerging Threats, Threat Intelligence, Vulnerabilities /

Hiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.JS Backdoor 2026-07-09 at 16:52 By Nathaniel Morales The LevelBlue Managed Threat Research team investigated a security alert in a customer environment involving a malicious ZIP file containing a Windows shortcut (.lnk) used for initial execution. When triggered, the LNK file executes a

Hiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.JS Backdoor Read More »

From Phishing to Persistence: A CrySome RAT Infection Chain Analysis

Emerging Threats, threat hunting, Threat Intelligence /

From Phishing to Persistence: A CrySome RAT Infection Chain Analysis 2026-07-06 at 17:00 By Sean Shirley and Kyle Sopt During a recent security alert, the LevelBlue MDR SOC successfully triaged and contained a structured, multi-stage infection chain designed to deliver the CrySome remote access trojan (RAT). The incident was subsequently analyzed in depth by LevelBlue’s

From Phishing to Persistence: A CrySome RAT Infection Chain Analysis Read More »

AsyncRAT and Remcos Delivered in Multi-Stage Phishing Campaign

Emerging Threats, Threat Intelligence /

AsyncRAT and Remcos Delivered in Multi-Stage Phishing Campaign 2026-07-02 at 17:00 By LevelBlue SpiderLabs Over the past two weeks, LevelBlue SpiderLabs has been tracking an active phishing campaign distributing malicious spreadsheet attachments. What initially appeared to be a limited phishing attempt quickly evolved into a widespread campaign impacting multiple organizations across various industries, including manufacturing,

AsyncRAT and Remcos Delivered in Multi-Stage Phishing Campaign Read More »

An Analysis of ValleyRAT Infection Campaigns from Fake Installers, Japanese Malicious Emails

Emerging Threats, Threat Intelligence /

An Analysis of ValleyRAT Infection Campaigns from Fake Installers, Japanese Malicious Emails 2026-06-30 at 17:04 By Hajime Takai Key points LevelBlue has identified two distinct attack vectors associated with ValleyRAT: campaigns leveraging fake installers and campaigns initiated through malicious emails. The malicious email-based attack campaign analyzed in this report appears to target both Chinese and

An Analysis of ValleyRAT Infection Campaigns from Fake Installers, Japanese Malicious Emails Read More »

RoguePlanet and GreatXML: Detecting Local Privilege Escalation and BitLocker Security Boundary Abuse

Emerging Threats /

RoguePlanet and GreatXML: Detecting Local Privilege Escalation and BitLocker Security Boundary Abuse 2026-06-17 at 21:58 By Serhii Melnyk Following our previous research, LevelBlue SpiderLabs continued monitoring a series of Windows security component disclosures published under multiple online aliases, including Nightmare-Eclipse, Chaotic Eclipse, Dead Eclipse, and most recently MSNightmare. This article is an excerpt from LevelBlue SpiderLabs

RoguePlanet and GreatXML: Detecting Local Privilege Escalation and BitLocker Security Boundary Abuse Read More »

AI Is Reshaping Cyber Risk Faster Than Most Boards Realize

Artificial Intelligence, Emerging Threats, Reports /

AI Is Reshaping Cyber Risk Faster Than Most Boards Realize 2026-06-17 at 17:00 By Artificial Intelligence is no longer a future cybersecurity concern. It is actively reshaping how attacks are conducted, how organizations respond, and how business leaders must think about enterprise risk. This article is an excerpt from LevelBlue Blog View Original Source

AI Is Reshaping Cyber Risk Faster Than Most Boards Realize Read More »

ClickFix Is Now Hiring: From Job Platform Impersonation to Python-Based RAT Delivery

Emerging Threats, News /

ClickFix Is Now Hiring: From Job Platform Impersonation to Python-Based RAT Delivery 2026-06-04 at 23:11 By King Orande and Cris Tomboc The LevelBlue OpsIntel CTI team examined the latest version of the ClickFix campaign, which emerged in early May 2026. The campaign employs a multi-stage phishing delivery chain that impersonates trusted employment and professional networking platforms,

ClickFix Is Now Hiring: From Job Platform Impersonation to Python-Based RAT Delivery Read More »

macOS ClickFix Social Engineering Campaigns

Emerging Threats, Vulnerabilities /

macOS ClickFix Social Engineering Campaigns 2026-06-04 at 22:23 By Maor Gabay Overview The “ClickFix” threat landscape has undergone a significant architectural shift, transitioning from legacy Windows-based execution to sophisticated macOS-targeted campaigns. These operations prioritize social engineering over software vulnerability exploitation, systematically leveraging established user behaviors and professional workflows. By presenting deceptive “fixes,” “verifications,” or installation

macOS ClickFix Social Engineering Campaigns Read More »

Scroll to Top