Pro-Russia Influence Networks Exploit September Drone Incursion into Poland
TL;DR Google Threat Intelligence Group (GTIG) observed multiple pro‑Russia information operation (IO) actors amplifying narratives after reported Russian drone incursions…
Defending Privileged Accounts: Monitoring Strategies for Modern IT Environments
TL;DR Mandiant outlines a threat-informed approach to protecting privileged accounts as cloud migration and non-human identities expand the attack surface.…
Cybersecurity Forecast 2026: Preparing Organizations for Emerging Threats
TL;DR Google Cloud published its Cybersecurity Forecast 2026 report on November 4, 2025, synthesizing frontline data and expert analysis to…
GTIG AI Threat Tracker: Threat Actors Deploy AI-Enabled Malware in 2025
TL;DR Google’s Threat Intelligence Group reports a shift from using AI for productivity to embedding LLMs inside malware, including dropper…
Triofox Vulnerability CVE-2025-12480: Unauthenticated Host-Header Bypass Enables RCE
TL;DR Mandiant reported exploitation of an unauthenticated access flaw in Gladinet’s Triofox (CVE-2025-12480) that allowed attackers to bypass authentication, create…
Time Travel Triage: Using Time Travel Debugging to Analyze .NET Hollowing
TL;DR Time Travel Debugging (TTD) in WinDbg lets analysts record a deterministic execution trace of a user-mode process and replay…
UNC1549 exploits third-party access, VDI breakouts and custom malware
TL;DR Mandiant's follow-up analysis details UNC1549 campaigns from late 2023 through 2025 targeting aerospace, aviation and defense sectors using supplier…
Beyond the Watering Hole — APT24 Shifts to Multi-Vector Espionage Attacks
TL;DR Google's Threat Intelligence Group is tracking a three-year campaign by APT24, a PRC-nexus actor, that uses a custom, heavily…
Sanctioned Intellexa Continues to Deploy Multiple Mobile Zero-Day Exploits
TL;DR Google's Threat Intelligence Group reports that Intellexa, despite US sanctions, remains an active commercial spyware vendor exploiting numerous mobile…