Top Security Breaches 2026-02-10

Auto-generated 2026-02-10T09:00:42.689861+00:00 (UTC)

1. Hackers breach SmarterTools network using flaw in its own software

   Source: BleepingComputer | Published: 2026-02-09T19:08:58+00:00 | Score: 21.126
   

   SmarterTools confirmed last week that the Warlock ransomware gang breached its network after compromising an email system, but did not impact business applications or account data. […]

   Original: https://www.bleepingcomputer.com/news/security/hackers-breach-smartertools-network-using-flaw-in-its-own-software/

2. Beyond the Battlefield: Threats to the Defense Industrial Base

   Source: Threat Intelligence | Published: 2026-02-10T14:00:00+00:00 | Score: 17.6
   

   Introduction In modern warfare, the front lines are no longer confined to the battlefield; they extend directly into the servers and supply chains of the industry that safeguards the nation. Today, the defense sector faces a relentless barrage of cyber operations conducted by state-sponsored actors and criminal groups alike. In recent years, Google Threat Intelligence Group (GTIG) has observed several distinct areas of focus in adversarial targeting of the defense industrial base (DIB). While not exhaustive of all actors and means, some of the more prominent themes in the landscape today include: Consistent effort has been dedicated to targeting defense entities fielding technologies on the battlefield in the Russia-Ukraine War. As next-generation capabilities are being operationalized in this environment, Russia-nexus threat actors and hacktivists are seeking to compromise defense contractors alongside military assets and systems, with a focus on organizations involved with unmanned aircraft systems (UAS). This includes targeting defense companies directly, using themes mimicking their products and systems in intrusions against military organizations and personnel. Across global defense and aerospace firms, the direct targeting of employees and exploitation of the hiring process has emerged as a key theme. From the North Korean IT worker threat, to the spoofing of recruitment portals by Iranian espionage actors, to the direct targeting of defense contractors’ personal emails, GTIG continues to observe a multifaceted threat landscape that centers around personnel, and often in a manner that evades traditional enterprise security visibility. Among state-sponsored cyber espionage intrusions over the last two years analysed by GTIG, threat activity from China-nexus groups continues to represent by volume the most active threat to entities in the defense industrial base. While these intrusions continue to leverage an array of tactics, campaigns from actors such as UNC3886 and UNC5221 highlight how the targeting of edge devices and appliances as a means of initial access has increased as a tactic by China-nexus threat actors, and poses a significant risk to the defense and aerospace sector. In comparison to the Russia-nexus threats observed on the battlefield in Ukraine, these could support more preparatory access or R&D theft missions. Lastly, contemporary national security strategy relies heavily on a secure supply chain. Since 2020, manufacturing has been the most represented sector across data leak sites (DLS) that GTIG tracks associated with ransomware and extortive activity. While dedicated defense and aerospace organizations represent a small fraction of similar activity, the broader manufacturing sector includes many companies that provide dual-use components for defense applications, and this statistic highlights the cyber risk the industrial base supply chain is exposed to. The ability to surge defense components in a wartime environment can be impacted, even when these intrusions are limited to IT networks. Additionally, the global resurgence of hacktivism, and actors carrying out hack and leak operations, DDoS attacks, or other forms of disruption, has impacted the defense industrial base. Across these themes we see further areas of commonality. Many of the chief state-sponsors of cyber espionage and hacktivist actors have shown an interest in autonomous vehicles and drones, as these platforms play an increasing role in modern warfare. Further, the “evasion of detection” trend first highlighted in the Mandiant M-Trends 2024 report continues, as actors focus on single endpoints and individuals, or carry out intrusions in a manner that seeks to avoid endpoint detection and response (EDR) tools altogether. All of this contributes to a contested and complex environment that challenges traditional detection strategies, requiring everyone from security practitioners to policymakers to think creatively in countering these threats. 1. Longstanding Russian Targeting of Critical and Emerging Defense Technologies in Ukraine and Beyond Russian espionage actors have demonstrated a longstanding interest in Western defense entities. While Russia’s full-scale invasion of Ukraine began in February 2022, the Russian government has long viewed the conflict as an extension of a broader campaign against Western encroachment into its sphere of influence, and has accordingly targeted both Ukrainian and Western military and defense-related entities via kinetic and cyber operations. Russia’s use of cyber operations in support of military objectives in the war against Ukraine and beyond is multifaceted. On a tactical level, targeting has broadened to include individuals in addition to organizations in order to support frontline operations and beyond, likely due at least in part to the reliance on public and off-the-shelf technology rather than custom products. Russian threat actors have targeted secure messaging applications used by the Ukrainian military to communicate and orchestrate military operations, including via attempts to exfiltrate locally stored databases of these apps, such as from mobile devices captured during Russia’s ongoing invasion of Ukraine. This compromise of individuals’ devices and accounts poses a challenge in various ways—for example, such activity often occurs outside spaces that are traditionally monitored, meaning a lack of visibility for defenders in monitoring or detecting such threats. GTIG has also identified attempts to compromise users of battlefield management systems such as Delta and Kropyva, underscoring the critical role played by these systems in the orchestration of tactical efforts and dissemination of vital intelligence. More broadly, Russian espionage activity has also encompassed the targeting of Ukrainian and Western companies supporting Ukraine in the conflict or otherwise focused on developing and providing defensive capabilities for the West. This has included the use of infrastructure and lures themed around military equipment manufacturers, drone production and development, anti-drone defense systems, and surveillance systems, indicating the likely targeting of organizations with a need for such technologies. APT44 (Sandworm, FROZENBARENTS) APT44, attributed by multiple governments to Unit 74455 within the Russian Armed Forces’ Main Intelligence Directorate (GRU) , has attempted to exfiltrate information from Telegram and Signal encrypted messaging applications, likely via physical access to devices obtained during operations in Ukraine. While this activity extends back to at least 2023, we have continued to observe the group making these attempts. GTIG has also identified APT44 leveraging WAVESIGN, a Windows Batch script responsible for decrypting and exfiltrating data from Signal Desktop. Multiple governments have also reported on APT44’s use of INFAMOUSCHISEL, malware designed to collect information from Android devices including system device information, commercial application information, and information from Ukrainian military apps. TEMP.Vermin TEMP.Vermin, an espionage actor whose activity Ukraine’s Computer Emergency Response Team (CERT-UA) has linked to security agencies of the so-called Luhansk People’s Republic (LPR, also rendered as LNR), has deployed malware including VERMONSTER, SPECTRUM (publicly reported as Spectr), and FIRMACHAGENT via the use of lure content themed around drone production and development, anti-drone defense systems, and video surveillance security systems. Infrastructure leveraged by TEMP.Vermin includes domains masquerading as Telegram and involve broad aerospace themes including a domain that may be a masquerade of an Indian aerospace company focused on advanced drone technology. Figure 1: Lure document used by TEMP.Vermin UNC5125 has conducted highly targeted campaigns focusing on frontline drone units. Its collection efforts have included the use of a questionnaire hosted on Google Forms to conduct reconnaissance against prospective drone operators; the questionnaire purports to originate from Dronarium, a drone training academy, and solicits personal information from targets, notably including military unit information, telephone numbers, and preferred mobile messaging apps. UNC5125 has also conducted malware delivery operations via these messaging apps. In one instance, the cluster delivered the MESSYFORK backdoor (publicly reported as COOKBOX ) to an UAV operator in Ukraine. Figure 2: UNC5125 Google Forms questionnaire purporting to originate from Dronarium drone training academy We also identified suspected UNC5125 activity leveraging Android malware we track as GREYBATTLE, which was delivered via a website spoofing a Ukrainian military artificial intelligence company. GREYBATTLE, a customized variant of the Hydra banking trojan, is designed to extract credentials and data from compromised devices. Note: Android users with Google Play Protect enabled are protected against the aforementioned malware, and all known versions of the malicious apps identified throughout this report. UNC5792 Since at least 2024, GTIG has identified this Russian espionage cluster exploiting secure messaging apps, targeting primarily Ukrainian military and government entities in addition to individuals and organizations in Moldova, Georgia, France, and the US. Notably, UNC5792 has compromised Signal accounts via the device-linking feature. Specifically, UNC5792 sent its targets altered “group invite” pages that redirected to malicious URLs crafted to link an actor-controlled device to the victim’s Signal accounts allowing the threat actor to see victims’ message in real time. The cluster has also leveraged WhatsApp phishing pages and other domains masquerading as Ukrainian defense manufacturing and defense technology companies. UNC4221 UNC4221, another suspected Russian espionage actor active since at least March 2022, has targeted secure messaging apps used by Ukrainian military personnel via tactics similar to those of UNC5792. For example, the cluster leveraged fake Signal group invites that redirect to a website crafted to elicit users to link their account to an actor-controlled Signal instance. UNC4221 has also leveraged WhatsApp phishing pages intended to collect geolocation data from targeted devices. UNC4221 has targeted mobile applications used by the Ukrainian military in multiple instances, such as by leveraging Signal phishing kits masquerading as Kropyva, a tactical battlefield app used by the Armed Forces of Ukraine for a variety of combat functions including artillery guidance. Other Signal phishing domains used by UNC4221 masqueraded as a streaming service for UAVs used by the Ukrainian military. The cluster also leveraged the STALECOOKIE Android malware, which was designed to masquerade as an application for Delta, a situational awareness and battlefield management platform used by the Ukrainian military, to steal browser cookies. UNC4221 has also conducted malware delivery operations targeting both Android and Windows devices. In one instance, the actor leveraged the “ClickFix” social engineering technique, which lured the target into copying and running malicious PowerShell commands via instructions referencing a Ukrainian defense manufacturer, in a likely attempt to deliver the TINYWHALE downloader. TINYWHALE in turn led to the download and execution of the MESHAGENT remote management software against a likely Ukrainian military entity. UNC5976 Starting in January 2025, the suspected Russian espionage cluster UNC5976 conducted a phishing campaign delivering malicious RDP connection files. These files were configured to communicate with actor-controlled domains spoofing a Ukrainian telecommunications entity. Additional infrastructure likely used by UNC5976 included hundreds of domains spoofing defense contractors including companies headquartered in the UK, the US, Germany, France, Sweden, Norway, Ukraine, Turkey, and South Korea. Figure 3: Identified UNC5976 credential harvesting infrastructure spoofing aerospace and defense firms Wider UNC5976 phishing activity also included the use of drone-themed lure content, such as operational documentation for the ORLAN-15 UAV system, likely for credential harvesting efforts targeting webmail credentials. Figure 4: Repurposed PDF document used by UNC5976 purporting to be operational documentation for the ORLAN-15 UAV system UNC6096 In February 2025, GTIG identified the suspected Russian espionage cluster UNC6096 conducting malware delivery operations via WhatsApp Messenger using themes related to the Delta battlefield management platform. To target Windows users, the cluster delivered an archive file containing a malicious LNK file leading to the download of a secondary payload. Android devices were targeted via malware we track as GALLGRAB, a modified version of the publicly available “Android Gallery Stealer”. GALLGRAB collects data that includes locally stored files, contact information, and potentially encrypted user data from specialized battlefield applications. UNC5114 In October 2023, the suspected Russian espionage cluster UNC5114 delivered a variant of the publicly available Android malware CraxsRAT masquerading as an update for the Kropyva app, accompanied by a lure document mimicking official installation instructions. Overcoming Technical Limitations with LLMs GTIG has recently discovered a threat group suspected to be linked to Russian intelligence services which conducts phishing operations to deliver CANFAIL malware primarily against Ukrainian organizations. Although the actor has targeted Ukrainian defense, military, government, and energy organizations within the Ukrainian regional and national governments, the group has also shown significant interest in aerospace organizations, manufacturing companies with military and drone ties, nuclear and chemical research organizations, and international organizations involved in conflict monitoring and humanitarian aid in Ukraine. Despite being less sophisticated and resourced than other Russian threat groups, this actor recently began to overcome some technical limitations using LLMs. Through prompting, they conduct reconnaissance, create lures for social engineering, and seek answers to basic technical questions for post-compromise activity and C2 infrastructure setup. In more recent phishing operations, the actor masqueraded as legitimate national and local Ukrainian energy organizations to target organizational and personal email accounts. They also imitated a Romanian energy company that works with customers in Ukraine, targeted a Romanian organization, and conducted reconnaissance on Moldovan organizations. The group generates lists of email addresses to target based on specific regions and industries discovered through their research. Phishing emails sent by the actor contain a lure that based on analysis appears to be LLM-generated, uses formal language and a specific official template, and Google Drive links which host a RAR archive containing CANFAIL malware, often disguised with a .pdf.js double extension. CANFAIL is obfuscated JavaScript which executes a PowerShell script to download and execute an additional stage, most commonly a memory-only PowerShell dropper. It additionally displays a fake “error” popup to the victim. This group’s activity has been documented by SentinelLABS and the Digital Security Lab of Ukraine in an October 2025 blog post detailing the “ PhantomCaptcha ” campaign, where the actor briefly used ClickFix in their operations. Hacktivist Targeting of Military Drones A subset of pro-Russia hacktivist activity has focused on Ukraine’s use of drones on the battlefield. This likely reflects the critical role that drones have played in combat, as well as an attempt by pro-Russia hacktivist groups to claim to be influencing events on the ground. In late 2025, the pro-Russia hacktivist collective KillNet, for example, dedicated significant threat activity to this. After announcing the collective’s revitalization in June, the first threat activity claimed by the group was an attack allegedly disabling Ukraine’s ability to monitor its airspace for drone attacks . This focus continued throughout the year, culminating in a December announcement in which the group claimed to create a multifunctional platform featuring the mapping of key infrastructure like Ukraine’s drone production facilities based on compromised data . We further detail in the next section operations from pro-Russia hacktivists that have targeted defense sector employees. 2. Employees in the Crosshairs: Targeting and Exploitation of Personnel and HR Processes in the Defense Sector Throughout 2025, adversaries of varying motivations have continued to target the “human layer” including within the DIB. By exploiting professional networking platforms, recruitment processes, and personal communications, threat actors attempt to bypass perimeter security controls to gain insider access or compromise personal devices. This creates a challenge for enterprise security teams, where much of this activity may take place outside the visibility of traditional security detections. North Korea’s Insider Threat and Revenue Generation Since at least 2019, the threat from the Democratic People’s Republic of Korea (DPRK) began evolving to incorporate internal infiltration via “IT workers” in addition to traditional network intrusion. This development, driven by both espionage requirements and the regime’s need for revenue generation, continued throughout 2025 with recent operations incorporating new publicly available tools . In addition to public reporting, GTIG has also observed evidence of IT workers applying to jobs at defense related organizations. In June 2025, the US Department of Justice announced a disruption operation that included searches of 29 locations in 16 states suspected of being laptop farms and led to the arrest of a US facilitator and an indictment against eight international facilitators. According to the indictment, the accused successfully gained remote jobs at more than 100 US companies, including Fortune 500 companies. In one case, IT workers reportedly stole sensitive data from a California-based defense contractor that was developing AI technology . In 2025, a Maryland-based individual, Minh Phuong Ngoc Vong, was sentenced to 15 months in prison for their role in facilitating a DPRK ITW scheme. According to government documents , in coordination with a suspected DPRK IT worker, Vong was hired by a Virginia-based company to perform remote software development work for a government contract that involved a US government entity’s defense program. The suspected DPRK IT worker used Vong’s credentials to log in and perform work under Vong’s identity, for which Vong was later paid, ultimately sending some of those funds overseas to the IT worker. The Industrialization of Job Campaigns Job-themed campaigns have become a significant and persistent operational trend among cyber threat actors, who leverage employment-themed social engineering as a high-efficacy vector for both espionage and financial gain. These operations exploit the trust inherent in the online job search, application, and interview processes, masquerading malicious content as job postings, fake job offers, recruitment documents, and malicious resume-builder applications to trick high-value personnel into deploying malware or providing credentials. North Korean Cyber Operations Targeting Defense Sector Employees North Korean cyber espionage operations have targeted defense technologies and personnel using employment themed social engineering. GTIG has directly observed campaigns conducted by APT45, APT43, and UNC2970 specifically target individuals at organizations within the defense industry. GTIG identified a suspected APT45 operation leveraging the SMALLTIGER malware to reportedly target South Korean defense, semiconductor, and automotive manufacturing entities. Based on historical activity, we suspect this activity is conducted at least in part to acquire intellectual property to support the North Korean regime in its research and development efforts in the targeted industries; South Korea’s National Intelligence Service (NIS) has also reported on North Korean attempts to steal intellectual property toward the aims of producing its own semiconductors for use in its weapons programs. GTIG identified suspected APT43 infrastructure mimicking German and U.S. defense-related entities, including a credential harvesting page and job-themed lure content used to deploy the THINWAVE backdoor. Related infrastructure was also used by HANGMAN.V2, a backdoor used by APT43 and suspected APT43 clusters. UNC2970 has consistently focused on defense targeting and impersonating corporate recruiters in their campaigns. The cluster has used Gemini to synthesize open-source intelligence (OSINT) and profile high-value targets to support campaign planning and reconnaissance. UNC2970’s target profiling included searching for information on major cybersecurity and defense companies and mapping specific technical job roles and salary information. This reconnaissance activity is used to gather the necessary information to create tailored, high-fidelity phishing personas and identify potential targets for initial compromise. Figure 5: Content of a suspected APT43 phishing page Iranian Threat Actors Use Recruitment-Themed Campaigns to Target Aerospace and Defense Employees GTIG has observed Iranian state-sponsored cyber actors consistently leverage employment opportunities and exploit trusted third-party relationships in operations targeting the defense and aerospace sector. Since at least 2022, groups such as UNC1549 and UNC6446 have used spoofed job portals, fake job offer lures, as well as malicious resume-builder applications for defense firms, some of which specialize in aviation, aerospace, and UAV technology, to trick users/personnel into executing malware or giving up credentials under the guise of legitimate employment opportunities. GTIG has identified fake job descriptions, portals, and survey lures hosted on UNC1549 infrastructure masquerading as aerospace, technology, and thermal imaging companies, including drone manufacturing entities, to likely target personnel interested in major defense contractors. Likely indicative of their intended targeting, in one campaign UNC1549 leveraged a spoofed domain for a drone-related conference in Asia. UNC1549 has additionally gained initial access to organizations in the defense and aerospace sector by exploiting trusted connections with third-party suppliers. The group leverages compromised third-party accounts to exploit legitimate access pathways, often pivoting from service providers to their customers. Once access is gained, UNC1549 has focused on privilege escalation by targeting IT staff with malicious emails that mimic authentic processes to steal administrator credentials, or by exploiting less-secure third-party suppliers to breach the primary target’s infrastructure via legitimate remote access services like Citrix and VMware. Post-compromise activities often include credential theft using custom tools like CRASHPAD and RDP session hijacking to access active user sessions. Since at least 2022, the Iranian-nexus threat actor UNC6446 has used resume builder and personality test applications to deliver custom malware primarily to targets in the aerospace and defense vertical across the US and Middle East. These applications provide a user interface – including one likely designed for employees of a UK-based multinational aerospace and defense company – while malware runs in the background to steal initial system reconnaissance data. Figure 6: Hiring-themed spear-phishing email sent by UNC1549 Figure 7: UNC1549 fake job offer on behalf of DJI, a drone manufacturing company China-Nexus Actor Targets Personal Emails of Defense Contractor Employees China-nexus threat actor APT5 conducted two separate campaigns in mid to late 2024 and in May 2025 against current and former employees of major aerospace and defense contractors. While employees at one of the companies received emails to their work email addresses, in both campaigns, the actor sent spearphishes to employees’ personal email addresses. The lures were meticulously crafted to align with the targets’ professional roles, geographical locations, and personal interests. Among the professional, industry, and training lures the actor leveraged included: Invitations to industry events, such as CANSEC (Canadian Association of Defence and Security Industries), MilCIS (Military Communications and Information Systems), and SHRM (Society for Human Resource Management). Red Cross training courses references. Phishing emails disguised as job offers. Additionally, the actor also leveraged hyper-specific and personal lures related to the locations and activities of their targetings, including: Emails referencing a “Community service verification form” from a local high school near one of the contractor’s headquarters. Phishing emails using “Alumni tickets” for a university minor league baseball team, targeting employees who attended the university. Emails purporting to be “open letters” to Boy Scouts of America camp or troop leadership, targeting employees known to be volunteers or parents. Fake guides and registration information leveraging the 2024 election cycle for the state where the employees lived. RU Hacktivists Targeting Personnel Doxxing remains a cornerstone of pro-Russia hacktivist threat activity, targeting both individuals within Ukraine’s military and security services as well as foreign allies. Some groups have centered their operations on doxxing to uncover members across specific units/organizations, while others use doxxing to supplement more diverse operations. For example, in 2025, the group Heaven of the Slavs (Original Russian: НЕБО СЛАВЯН) claimed to have doxxed Ukrainian defense contractors and military officials ; Beregini alleged to identify individuals who worked at Ukrainian defense contractors, including those that it claimed worked at Ukrainian naval drone manufacturers ; and PalachPro claimed to have identified foreign fighters in Ukraine, and the group separately claimed to have compromised the devices of Ukrainian soldiers . Further hacktivist activity against the defense sector is covered in the last section of this report. 3. Persistent Area of Focus For China-Nexus Cyber Espionage Actors The defense industrial base has been an important target for China-nexus threat actors for as long as cyber operations have been used for espionage. One of the earliest observed compromises attributed to the Chinese military’s APT1 group was a firm in the defense industrial sector in 2007. While historical campaigns by actors such as APT40 have at times shown hyper-specific focus in sub-sectors of defense, such as maritime related technologies, in general the areas of defense targeting from China-nexus groups has spanned all domains and supply chain layers. Alongside this focus on defense systems and contractors, Chinese cyber espionage groups have steadily improved their tradecraft over the past several years, increasing the risk to this sector. GTIG has observed more China-nexus cyber espionage missions directly targeting defense and aerospace industry than from any other state-sponsored actors over the last two years. China-nexus espionage actors have used a broad range of tactics in operations, but the hallmark of many operations has been their exploitation of edge devices to gain initial access. We have also observed China-nexus threat groups leverage ORB networks for reconnaissance against defense industrial targets, which complicates detection and attribution. Figure 8: Edge vs. not edge zero-days likely exploited by CN actors 2021 — September 2025 Drawing from both direct observations and open-source research, GTIG assesses with high confidence that since 2020, Chinese cyber espionage groups have exploited more than two dozen zero-day (0-day) vulnerabilities in edge devices (devices that are typically placed at the edge of a network and often do not support EDR monitoring, such as VPNs, routers, switches, and security appliances) from ten different vendors. This observed emphasis on exploiting 0-days in edge devices likely reflects an intentional strategy to benefit from the tactical advantages of reduced opportunities for detection and increased rates of successful compromises. While we have observed exploitation spread to multiple threat groups soon after disclosure, often the first Chinese cyber espionage activity sets we discover exploiting an edge device 0-day, such as UNC4841, UNC3886, and UNC5221, demonstrate extensive efforts to obfuscate their activity in order to maintain long-term access to targeted environments. Notably, in recent years, both UNC3886 and UNC5221 operations have directly impacted the defense sector, among other industries. UNC3886 is one of the most capable and prolific China-nexus threat groups GTIG has observed in recent years. While UNC3886 has targeted multiple sectors, their early operations in 2022 had a distinct focus on aerospace and defense entities. We have observed UNC3886 employ 17 distinct malware families in operations against DIB targets. Beyond aerospace and defense targets, UNC3886 campaigns have been observed impacting the telecommunications and technology sectors in the US and Asia. UNC5221 is a sophisticated, suspected China-nexus cyber espionage actor characterized by its focus on exploiting edge infrastructure to penetrate high-value strategic targets. The actor demonstrates a distinct operational preference for compromising perimeter devices—such as VPN appliances and firewalls—to bypass traditional endpoint detection, subsequently establishing persistent access to conduct long-term intelligence collection. Their observed targeting profile is highly selective, prioritizing entities that serve as “force multipliers” for intelligence gathering, such as managed service providers (MSPs), law firms, and central nodes in the global technology supply chain. The BRICKSTORM malware campaign uncovered in 2025, which we suspect was conducted by UNC5221, was notable for its stealth, with an average dwell time of 393 days. Organizations that were impacted spanned multiple sectors but included aerospace and defense. In addition to these two groups, GTIG has analysed other China-nexus groups impacting the defense sector in recent years. UNC3236 Observed Targeting U.S. Military and Logistics Portal In 2024, GTIG observed reconnaissance activity associated with UNC3236 (linked to Volt Typhoon) against publicly hosted login portals of North American military and defense contractors, and U.S. and Canadian government domains related to North American infrastructure. The activity leveraged the ARCMAZE obfuscation network to obfuscate its origin. Netflow analysis revealed communication with SOHO routers outside the ARCMAZE network, suggesting an additional hop point to hinder tracking. Targeted entities included a Drupal web login portal used by defense contractors involved in U.S. military infrastructure projects. UNC6508 Search Terms Indicate Interest in Defense Contractors and Military Platforms In late 2023, China-nexus threat cluster UNC6508 targeted a US-based research institution through a multi-stage attack that leveraged an initial REDCap exploit and custom malware named INFINITERED. This malware is embedded within a trojanized version of a legitimate REDCap system file and functions as a recursive dropper. It is capable of enabling persistent remote access and credential theft after intercepting the application’s software upgrade process to inject malicious code into the next version’s core files. The actor used the REDCap system access to collect credentials to access the victim’s email platform filtering rules to collect information related to US national security and foreign policy (Figure 10). GTIG assesses with low confidence that the actors likely sought to fulfill a set of intelligence collection requirements, though the nature and intended focus of the collection effort are unknown. Figure 9: Categories of UNC6508 email forwarding triggers By August 2025, the actors leveraged credentials obtained via INFINITERED to access the institution’s environment with legitimate, compromised administrator credentials. They abused the tenant compliance rules to dynamically reroute messages based on a combination of keywords and or recipients. The actors modified an email rule to BCC an actor-controlled email address if any of 150 regex-defined search terms or email addresses appeared in email bodies or subjects, thereby facilitating data exfiltration by forwarding any email that contained at least one of the terms related to US national security, military equipment and operations, foreign policy, and medical research, among others. About a third of the keywords referenced a military system or a defense contractor, with a notable amount related to UAS or counter-UAS systems. 4. Hack, Leak, and Disruption of the Manufacturing Supply Chain Extortion operations continue to represent the most impactful cyber crime threat globally, due to the prevalence of the activity, the potential for disrupting business operations, and the public disclosure of sensitive data such as personally identifiable information (PII), intellectual property, and legal documents. Similarly, hack-and-leak operations conducted by geopolitically and ideologically motivated hacktivist groups may also result in the public disclosure of sensitive data. These data breaches can represent a risk to defense contractors via loss of intellectual property, to their employees due to the potential use of PII for targeting data, and to the defense agencies they support. Less frequently, both financially and ideologically motivated threat actors may conduct significant disruptive operations, such as the deployment of ransomware on operational technology (OT) systems or distributed-denial-of-service (DDoS) attacks. Cyber Crime Activity Impacting the Defense Industrial Base and Broader Manufacturing and Industrial Supply Chain While dedicated aerospace & defense organizations represent only about 1% of victims listed on data leak sites (DLS) in 2025, manufacturing organizations, many of which directly or indirectly support defense contracts, have consistently represented the largest share of DLS listings by count (Figure 11). This broader manufacturing sector includes companies that may provide dual-use components for defense applications. For example, a significant 2025 ransomware incident affecting a UK automotive manufacturer, who also produces military vehicles, disrupted production for weeks and reportedly affected more than 5,000 additional organizations. This highlights the cyber risk to the broader industrial supply chain supporting the defense capacity of a nation, including the ability to surge defense components in a wartime environment can be impacted, even when these intrusions are limited to IT networks. Figure 10: Percent of DLS victims in the manufacturing industry by quarter Threat actors also regularly share and/or advertise illicit access to or stolen data from aerospace and defense sector organizations. For example, the persona “miyako,” who has been active on multiple underground forums based on the use of the same username and Session ID, has advertised access to multiple, unnamed, defense contractors over time (Figure 11). While defense contractors are likely not attractive targets for many cyber criminals, given that these organizations typically maintain a strong security posture, a small subset of financially motivated actors may disproportionately target the industry due to dual motivations, such as a desire for notoriety or ideological motivations. For example, the BreachForums actor “USDoD” regularly shared or advertised access to data claimed to have been stolen from prominent defense-related organizations. In a bizarre 2023 interview, USDoD claimed the threat was misdirection and that they were actually targeting a consulting firm, NATO, CEPOL, Europol, and Interpol. USDoD further indicated that they had a personal vendetta and were not motivated by politics. In October 2024, Brazilian authorities arrested an individual accused of being USDoD. Figure 11: Advertisement for “US Navy / USAF / USDoD Engineering Contractor” Hacktivist Operations Targeting the Defense Industrial Base Pro-Russia and pro-Iran hacktivism operations at times extend beyond simple nuisance-level attacks to high-impact operations, including data leaks and operational disruptions. Unlike financially motivated activity, these campaigns prioritize the exposure of sensitive military schematics and personal personnel data—often through “hack-and-leak” tactics—in an attempt to erode public trust, intimidate defense officials, and influence geopolitical developments on the ground. Robust geopolitically motivated hacktivist activity works not only to advance state interests but also can serve to complicate attribution of threat activity from state-backed actors, which are known to leverage hacktivist tactics for their own ends. Figure 12: Notable 2025 hacktivist claims allegedly involving the defense industrial base Pro-Russia Hacktivism Activity Pro-Russia hacktivist actors have collectively dedicated a notable portion of their threat activity to targeting entities associated with Ukraine’s and Western countries’ militaries and in their defense sectors. As we have previously reported , GTIG observed a revival and intensification of activity within the pro-Russia hacktivist ecosystem in response to the launch of Russia’s full-scale invasion of Ukraine in February 2022. The vast majority of pro-Russia hacktivist activity that we have subsequently tracked has likewise appeared intended to advance Russia’s interests in the war. As with the targeting of other high-profile organizations, at least some of this activity appeared primarily intended to generate media attention. However, a review of the related threat activity observed in 2025 also suggest that actors targeting military/defense sectors had more diverse objectives, including seeding influence narratives, monetizing claimed access, and influencing developments on the ground. Some observed attack/targeting trends over the last year include the following: DDoS Attacks: Multiple pro-Russia hacktivist groups have claimed distributed denial-of-service (DDoS) attacks targeting government and private organizations involved in defense. This includes multiple such attacks claimed by the group NoName057(16), which has prolifically leveraged DDoS attacks to attack a range of targets . While this often may be more nuisance-level activity, it demonstrates at the most basic level how defense sector targeting is a part of hacktivist threat activity that is broadly oriented toward targeting entities in countries that support Ukraine. Network Intrusion: In limited instances, pro-Russia groups claimed intrusion activity targeting private defense-sector organizations. Often this was in support of hack and leak operations. For example, in November 2025, the group PalachPro claimed to have targeted multiple Italian defense companies, alleging that they exfiltrated sensitive data from their networks—in at least one instance, PalachPro claimed it would sell this data ; that same month, the group Infrastructure Destruction Squad claimed to have launched an unsuccessful attack targeting a major US arms producer . Document Leaks: A continuous stream of claimed or otherwise implied hack and leak operations has targeted the Ukrainian military and the government and private organizations that support Ukraine. Beregini and JokerDNR (aka JokerDPR) are two notable pro-Russia groups engaged in this activity, both of which regularly disseminate documents that they claim are related to the administration of Ukraine’s military, coordination with Ukraine’s foreign partners, and foreign weapons systems supplied to Ukraine. GTIG cannot confirm the potential validity of all the disseminated documents, though in at least some instances the sensitive nature of the documents appears to be overstated. Often, Beregini and JokerDNR leverage this activity to promote anti-Ukraine narratives, including those that appear intended to reduce domestic confidence in the Ukrainian government by alleging things like corruption and government scandals, or that Ukraine is being supplied with inferior equipment . Pro-Iran Hacktivism Activity Pro-Iran hacktivist threat activity targeting the defense sector has intensified significantly following the onset of the Israel-Hamas conflict in October 2023. These operations are characterized by a shift from nuisance-level disruptive attacks to sophisticated “hack-and-leak” campaigns, supply chain compromises, and aggressive psychological warfare targeting military personnel. Threat actors such as Handala Hack, Cyber Toufan, and the Cyber Isnaad Front have prioritized the Israeli defense industrial base—compromising manufacturers, logistics providers, and technology firms to expose sensitive schematics, personnel data, and military contracts. The objective of these campaigns is not merely disruption but the degradation of Israel’s national security apparatus through the exposure of military capabilities, the intimidation of defense sector employees via “doxxing,” and the erosion of public trust in the security establishment. The pro-Iran persona Handala Hack, which GTIG has observed publicize threat activity associated with UNC5203, has consistently targeted both the Israeli Government, as well as its supporting military-industrial complex. Threat activity attributed to the persona has primarily consisted of hack-and-leak operations, but has increasingly incorporated doxxing and tactics designed to promote fear, uncertainty, and doubt (FUD). On the two-year anniversary of al-Aqsa Flood, the day which Hamas-led militants attacked Israel, Handala launched “Handala RedWanted,” an actor-controlled website supporting a concerted doxxing/intimidation campaign targeting members of Israel’s Armed Forces, its intelligence and national security apparatus, and both individuals and organizations the group claims to comprise Israel’s military-industrial complex. Following the announcement of RedWanted, the persona has recently signaled an expansion of its operations vis-a-vis the launch of “Handala Alert.” Significant in terms of a potential expansion in the group’s external targeting calculus, which has long prioritized Israel, is a renewed effort by Handala to “support anti-regime activities abroad.” Ongoing campaigns such as those attributed to the Pro-Iran personas Cyber Toufan (UNC5318) and الجبهة الإسناد السيبرانية (Cyber Isnaad Front) are additionally demonstrative of the broader ecosystem’s longstanding prioritization of the defense sector. Leveraging a newly-established leak channel on Telegram (ILDefenseLeaks ), Cyber Toufan has publicized a number of operations targeting Israel’s military-industrial sector, most of which the group claims to have been the result of a supply chain compromise resulting from its breach of network infrastructure associated with an Israeli defense contractor. According to Cyber Toufan, access to this contractor resulted in the compromise of at least 17 additional Israeli defense contractor organizations. While these activities have prioritized the targeting of Israel specifically, claimed operations have in limited instances impacted other countries. For example, recent threat activity publicized by Cyber Isnaad Front also surrounding the alleged compromise of the aforementioned Israeli defense contractor leaked information involving reported plans by the Australian Defense Force to purchase Spike NLOS anti-tank missiles from Israel . Conclusion Given global efforts to increase defense investment and develop new technologies the security of the defense sector is more important to national security than ever. Actors supporting nation state objectives have interest in the production of new and emerging defense technologies, their capabilities, the end customers purchasing them, and potential methods for countering these systems. Financially motivated actors carry out extortion against this sector and the broader manufacturing base like many of the other verticals they target for monetary gain. While specific risks vary by geographic footprint and sub-sector specialization, the broader trend is clear: the defense industrial base is under a state of constant, multi-vector siege. The campaigns against defense contractors in Ukraine, threats to or exploitation of defense personnel, the persistent volume of intrusions by China-nexus actors, and the hack, leak, and disruption of the manufacturing base are some of the leading threats to this industry today. To maintain a competitive advantage, organizations must move beyond reactive postures. By integrating these intelligence trends into proactive threat hunting and resilient architecture, the defense sector can ensure that the systems protecting the nation are not compromised before they ever reach the field.

   Original: https://cloud.google.com/blog/topics/threat-intelligence/threats-to-defense-industrial-base/

3. European Commission discloses breach that exposed staff data

   Source: BleepingComputer | Published: 2026-02-09T09:49:04+00:00 | Score: 17.342
   

   The European Commission is investigating a breach after finding evidence that its mobile device management platform was hacked. […]

   Original: https://www.bleepingcomputer.com/news/security/european-commission-discloses-breach-that-exposed-staff-data/

4. Notepad++ Hosting Breach Attributed to China-Linked Lotus Blossom Hacking Group

   Source: The Hacker News | Published: 2026-02-03T04:55:00+00:00 | Score: 15.789
   

   A China-linked threat actor known as Lotus Blossom has been attributed with medium confidence to the recently discovered compromise of the infrastructure hosting Notepad++.
   The attack enabled the state-sponsored hacking group to deliver a previously undocumented backdoor codenamed Chrysalis to users of the open-source editor, according to new findings from Rapid7.
   The development comes shortly

   Original: https://thehackernews.com/2026/02/notepad-hosting-breach-attributed-to.html

5. Dutch Authorities Confirm Ivanti Zero-Day Exploit Exposed Employee Contact Data

   Source: The Hacker News | Published: 2026-02-10T08:22:00+00:00 | Score: 14.692
   

   The Netherlands’ Dutch Data Protection Authority (AP) and the Council for the Judiciary confirmed both agencies (Rvdr) have disclosed that their systems were impacted by cyber attacks that exploited the recently disclosed security flaws in Ivanti Endpoint Manager Mobile (EPMM), according to a notice sent to the country’s parliament on Friday.
   “On January 29, the National Cyber Security Center (

   Original: https://thehackernews.com/2026/02/dutch-authorities-confirm-ivanti-zero.html

6. Asian State-Backed Group TGR-STA-1030 Breaches 70 Government, Infrastructure Entities

   Source: The Hacker News | Published: 2026-02-06T12:07:00+00:00 | Score: 13.539
   

   A previously undocumented cyber espionage group operating from Asia broke into the networks of at least 70 government and critical infrastructure organizations across 37 countries over the past year, according to new findings from Palo Alto Networks Unit 42.
   In addition, the hacking crew has been observed conducting active reconnaissance against government infrastructure associated with 155

   Original: https://thehackernews.com/2026/02/asian-state-backed-group-tgr-sta-1030.html

7. How Samsung Knox Helps Stop Your Network Security Breach

   Source: The Hacker News | Published: 2026-02-06T10:30:00+00:00 | Score: 13.519
   

   As you know, enterprise network security has undergone significant evolution over the past decade. Firewalls have become more intelligent, threat detection methods have advanced, and access controls are now more detailed. However (and it’s a big “however”), the increasing use of mobile devices in business operations necessitates network security measures that are specifically

   Original: https://thehackernews.com/2026/02/how-samsung-knox-helps-stop-your-network-security-breach.html

8. Guidance from the Frontlines: Proactive Defense Against ShinyHunters-Branded Data Theft Targeting SaaS

   Source: Threat Intelligence | Published: 2026-01-30T14:00:00+00:00 | Score: 13.301
   

   Introduction Mandiant is tracking a significant expansion and escalation in the operations of threat clusters associated with ShinyHunters-branded extortion. As detailed in our companion report, ‘Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft’ , these campaigns leverage evolved voice phishing (vishing) and victim-branded credential harvesting to successfully compromise single sign-on (SSO) credentials and enroll unauthorized devices into victim multi-factor authentication (MFA) solutions. This activity is not the result of a security vulnerability in vendors’ products or infrastructure. Instead, these intrusions rely on the effectiveness of social engineering to bypass identity controls and pivot into cloud-based software-as-a-service (SaaS) environments. This post provides actionable hardening , logging , and detection recommendations to help organizations protect against these threats. Organizations responding to an active incident should focus on rapid containment steps, such as severing access to infrastructure environments, SaaS platforms, and the specific identity stores typically used for lateral movement and persistence. Long-term defense requires a transition toward phishing-resistant MFA , such as FIDO2 security keys or passkeys, which are more resistant to social engineering than push-based or SMS authentication. Containment Organizations responding to an active or suspected intrusion by these threat clusters should prioritize rapid containment to sever the attacker’s access to prevent further data exfiltration. Because these campaigns rely on valid credentials rather than malware, containment must prioritize the revocation of session tokens and the restriction of identity and access management operations. Immediate Containment Actions Revoke active sessions: Identify and disable known compromised accounts and revoke all active session tokens and OAuth authorizations across IdP and SaaS platforms. Restrict password resets: Temporarily disable or heavily restrict public-facing self-service password reset portals to prevent further credential manipulation.  Do not allow the use of self-service password reset for administrative accounts. Pause MFA registration: Temporarily disable the ability for users to register, enroll, or join new devices to the identity provider (IdP). Limit remote access: Restrict or temporarily disable remote access ingress points, such as VPNs, or Virtual Desktops Infrastructure (VDI), especially from untrusted or non-compliant devices. Enforce device compliance: Restrict access to IdPs and SaaS applications so that authentication can only originate from organization-managed, compliant devices and known trusted egress locations. Implement ‘shields up’ procedures: Inform the service desk of heightened risk and shift to manual, high-assurance verification protocols for all account-related requests. In addition, remind technology operations staff not to accept any work direction via SMS messages from colleagues. During periods of heightened threat activity, Mandiant recommends that organizations temporarily route all password and MFA resets through a rigorous manual identity verification protocol, such as the live video verification described in the Hardening section of this post. When appropriate, organizations should also communicate with end-users, HR partners, and other business units to stay on high-alert during the initial containment phase. Always report suspicious activity to internal IT and Security for further investigation. 1. Hardening Defending against threat clusters associated with ShinyHunters-branded extortion begins with tightening manual, high-risk processes that attackers frequently exploit, particularly password resets, device enrollments, and MFA changes. Help Desk Verification Because these campaigns often target human-driven workflows through social engineering, vishing, and phishing, organizations should implement stronger, layered identity verification processes for support interactions, especially for requests involving account changes such as password resets or MFA modifications. Threat actors have also been known to impersonate third-party vendors to voice phish (vish) help desks and persuade staff to approve or install malicious SaaS application registrations. As a temporary measure during heightened risk, organizations should require verification that includes the caller’s identity, a valid ID, and a visual confirmation that the caller and ID match. To implement this, organizations should require help desk personnel to: Require a live video call where the user holds a physical government ID next to their face. The agent must visually verify the match. Confirm the name on the ID matches the employee’s corporate record. Require out-of-band approval from the user’s known manager before processing the reset. Reject requests based solely on employee ID, SSN, or manager name. ShinyHunters possess this data from previous breaches and may use it to verify their identity. If the user calls the helpdesk for a password reset, never perform the reset without calling the user back at a known good phone number to prevent spoofing. If a live video call is not possible, require an alternative high-assurance path. It may be required for the user to come in person to verify their identity. Optionally, after a completed interaction, the help desk agent can send an email to the user’s manager indicating that the change is complete with a picture from the video call of the user who requested the change on camera. Special Handling for Third-Party Vendor Requests Mandiant has observed incidents where attackers impersonate support personnel from third-party vendors to gain access. In these situations, the standard verification principals may not be applicable. Under no circumstances should the Help Desk move forward with allowing access. The agent must halt the request and follow this procedure: End the inbound call without providing any access or information Independently contact the company’s designated account manager for that vendor using trusted, on-file contact information Require explicit verification from the account manager before proceeding with any request End User Education Organizations should educate end users on best practices especially when being reached out directly without prior notice. Conduct internal Vishing and Phishing exercises to validate end user adoption of security best practices . Educate that passwords should not be shared, regardless of who is asking for it. Encourage users to exercise extreme caution when being requested to reset their own passwords and MFA; especially during off-business hours. If they are unsure of the person or number they are being contacted by, have them cease all communications and contact a known support channel for guidance. Identity & Access Management Organizations should implement a layered series of controls to protect all types of identities. Access to cloud identity providers (IdPs), cloud consoles, SaaS applications, document and code repositories should be restricted since these platforms often become the control plane for privilege escalation, data access, and long-term persistence. This can be achieved by: Limiting access to trusted egress points and physical locations Review and understand what “local accounts” exist within SaaS platforms: Ensure any default username/passwords have been updated according to the organization’s password policy. Limit the use of ‘local accounts’ that are not managed as part of the organization’s primary centralized IdP. Reducing the scope of non-human accounts (access keys, tokens, and non-human accounts) Where applicable, organizations should implement network restrictions across non-human accounts. Activity correlating to long-lived tokens (OAuth / API) associated with authorized / trusted applications should be monitored to detect abnormal activity. Limit access to organization resources from managed and compliant devices only. Across managed devices: Implement device posture checks via the Identity Provider. Block access from devices with prolonged inactivity. Block end users ability to enroll personal devices. Where access from unmanaged devices is required, organizations should: Limit non-managed devices to web only views. Disable ability to download/store corporate/business data locally on unmanaged personal devices. Limit session durations and prompt for re-authentication with MFA. Rapid enhancement to MFA methods, such as: Removal of SMS, phone call, push notification, and/or email as authentication controls. Requiring strong, phishing resistant MFA methods such as: Authenticator apps that require phishing resistant MFA (FIDO2 Passkey Support may be added to existing methods such as Microsoft Authenticator.) FIDO2 security keys for authenticating identities that are assigned privileged roles. Enforce multi-context criteria to enrich the authentication transaction. Examples include not only validating the identity, but also specific device and location attributes as part of the authentication transaction. For organizations that leverage Google Workspace, these concepts can be enforced by using context-aware access policies. For organizations that leverage Microsoft Entra ID, these concepts can be enforced by using a Conditional Access Policy. For organizations that leverage Okta, these concepts can be enforced by using Okta policies and rules. Attackers are consistently targeting non-human identities due to the limited number of detections around them, lack of baseline of normal vs abnormal activity, and common assignment of privileged roles attached to these identities. Organizations should: Identify and track all programmatic identities and their usage across the environment, including where they are created, which systems they access, and who owns them. Centralize storage in a secrets manager (cloud-native or third-party) and prevent credentials from being embedded in source code, config files, or CI/CD pipelines. Restrict authentication IPs for programmatic credentials so they can only be used from trusted third-party or internal IP ranges wherever technically feasible. Transition to workload identity federation: Where feasible, replace long-lived static credentials (such as AWS access keys or service account keys) with workload identity federation mechanisms (often based on OIDC). This allows applications to authenticate using short-lived, ephemeral tokens issued by the cloud provider, dramatically reducing the risk of credential theft from code repositories and file systems. Enforce strict scoping and resource binding by tying credentials to specific API endpoints, services, or resources. For example, an API key should not simply have “read” access to storage, but be limited to a particular bucket or even a specific prefix, minimizing blast radius if it is compromised. Baseline expected behavior for each credential type (typical access paths, destinations, frequency, and volume) and integrate this into monitoring and alerting so anomalies can be quickly detected and investigated. Additional platform-specific hardening measures include: Okta Enable Okta ThreatInsight to automatically block IP addresses identified as malicious. Restrict Super Admin access to specific network zones (corporate VPN). Microsoft Entra ID Implement common Conditional Access Policies to block unauthorized authentication attempts and restrict high-risk sign-ins. Configure risk-based policies to trigger password changes or MFA when risk is detected. Restrict who is allowed to register applications in Entra ID and require administrator approval for all application registrations. Google Workspace Use Context-Aware Access levels to restrict Google Drive and Admin Console access based on device attributes and IP address. Enforce 2-Step Verification (2SV) for all Google Workspace users. Use Advanced Protection to protect high-risk users from targeted phishing, malware, and account hijacking. Infrastructure and Application Platforms Infrastructure and application platforms such as Cloud consoles and SaaS applications are frequent targets for credential harvesting and data exfiltration. Protecting these systems typically requires implementing the previously outlined identity controls, along with platform-specific security guardrails, including: Restrict management-plane access so it’s only reachable from the organization’s network and approved VPN ranges. Scan for and remediate exposed secrets, including sensitive credentials stored across these platforms. Enforce device access controls so access is limited to managed, compliant devices. Monitor configuration changes to identify and investigate newly created resources, exposed services, or other unauthorized modifications. Implement logging and detections to identify: Newly created or modified network security group (NSG) rules, firewall rules, or publicly exposed resources that enable remote access. Creation of programmatic keys and credentials (e.g., access keys). Disable API/CLI access for non-essential users by restricting programmatic access to those who explicitly require it for management-plane operations. Platform Specifics GCP Configure security perimeters with VPC Service Controls (VPC-SC) to prevent data from being copied to unauthorized Google Cloud resources even if they have valid credentials. Set additional guardrails with organizational policies and deny policies applied at the organization level. This stops developers from introducing misconfigurations that could be exploited by attackers. For example, enforcing organizational policies like “iam.disableServiceAccountKeyCreation” will prevent generating new unmanaged service account keys that can be easily exfiltrated. Apply IAM Conditions to sensitive role bindings. Restrict roles so they only activate if the resource name starts with a specific prefix or if the request comes during specific working hours. This limits the blast radius of a compromised credential. AWS Apply Service Control Policies (SCPs) at the root level of the AWS Organization that limit the attack surface of AWS services. For example, deny access in unused regions, block creation of IAM access keys, and prevent deletion of backups, snapshots, and critical resources. Define data perimeters through Resource Control Policies (RCPs) that restrict access to sensitive resources (like S3 buckets) to only trusted principals within your organization, preventing external entities from accessing data even with valid keys. Implement alerts on common reconnaissance commands such as GetCallerIdentity API calls originating from non-corporate IP addresses. This is often the first reconnaissance command an attacker runs to verify their stolen keys. Azure Enforce Conditional Access Policies (CAPs) that block access to administrative applications unless the device is “Microsoft Entra hybrid joined” and “Compliant.” This prevents attackers from accessing resources using their own tools or devices. Eliminate standing admin access and require Just-In-Time (JIT) through Privileged Identity Management (PIM) for elevation for roles such as Global Administrator, mandating an approval workflow and justification for each activation. Enforce the use of Managed Identities for Azure resources accessing other services. This removes the need for developers to handle or rotate credentials for service principals, eliminating the static key attack vector. Source Code Management Enforce Single Sign-On (SSO) with SCIM for automated lifecycle management and mandate FIDO2/WebAuthn to neutralize phishing. Additionally, replace broad access tokens with short-lived, Fine-Grained Personal Access Tokens (PATs) to enforce least privilege. Prevent credential leakage by enabling native “Push Protection” features or implementing blocking CI/CD workflows (such as TruffleHog) that automatically reject commits containing high-entropy strings before they are merged. Mitigate the risk of malicious code injection by requiring cryptographic commit signing (GPG/S/MIME) and mandating a minimum of two approvals for all Pull Requests targeting protected branches. Conduct scheduled historical scans to identify and purge latent secrets that evaded preventative controls, ensuring any compromised credentials are immediately rotated and forensically investigated. Salesforce Reference Mandiant’s Salesforce Hardening blog post Reference Salesforce “ Protecting Salesforce Data After an Identity Compromise ” blog post 2. Logging Modern SaaS intrusions rarely rely on payloads or technical exploits. Instead, Mandiant consistently observes attackers leveraging valid access (frequently gained via vishing or MFA bypass) to abuse native SaaS capabilities such as bulk exports, connected apps, and administrative configuration changes. Without clear visibility into these environments, detection becomes nearly impossible. If an organization cannot track which identity authenticated, what permissions were authorized, and what data was exported, they often remain unaware of a campaign until an extortion note appears. This section focuses on ensuring your organization has the necessary visibility into identity actions, authorizations, and SaaS export behaviors required to detect and disrupt these incidents before they escalate. Identity Provider If an adversary gains access through vishing and MFA manipulation, the first reliable signals will appear in the SSO control plane, not inside a workstation. In this example, the goal is to ensure Okta and Entra ID ogs identify who authenticated, what MFA changes occurred, and where access originated from. What to Enable and Ingest into the SIEM Okta Authentication events (successful and failed sign-ins) MFA lifecycle events (enrollment/activation and changes to authentication factors or devices) Administrative identity events that capture security-relevant actions (e.g., changes that affect authentication posture) Entra ID Authentication events Audit logs for MFA changes / authentication method Audit logs for security posture changes that affect authentication Conditional Access policy changes Changes to Named Locations / trusted locations What “Good” Looks Like Operationally You should be able to quickly identify: Authentication factor, device enrollment activity, and the user responsible Source IP, geolocation, (and ASN if available) associated with that enrollment Whether access originated from the organization’s expected egress and identify access paths Platform Google Workspace Logging Defenders should ensure they have visibility into OAuth authorizations, mailbox deletion activity (including deletion of security notification emails), and Google Takeout exports . What You Need in Place Before Logging Correct edition + investigation surfaces available: Confirm your Workspace edition supports the Audit and investigation tool and the Security Investigation tool (if you plan to use it). Correct admin privileges: Ensure the account has Audit & Investigation privilege (to access OAuth/Gmail/Takeout log events) and Security Center privilege. If you need Gmail message content: Validate edition + privileges allow viewing message content during investigations. What to Enable and Ingest into the SIEM OAuth / App authorization logs Enable and ingest token/app authorization logs to observe: Which application was authorized (app name + identifier) Which user granted access What scopes were granted Source IP and geolocation for the authorization This is the telemetry required to detect suspicious app authorizations and add-on enablement that can support mailbox manipulation. Gmail audit logs Enable and ingest Gmail audit events that capture: Message deletion actions (including permanent delete where available) Message direction indicators (especially useful for outbound cleanup behavior) Message metadata (e.g., subject) to support detection of targeted deletions of security notification emails Google Takeout audit logs Enable and ingest Takeout logs to capture: Export initiation and completion events User and source IP/geo for the export activity Salesforce Logging Activity observed by Mandiant includes the use of Salesforce Data Loader and large-scale access patterns that won’t be visible if only basic login history logs are collected. Additional Salesforce telemetry that captures logins, configuration changes, connected app/API activity, and export behavior is needed to investigate SaaS-native exfiltration. Detailed implementation guidance for these visibility gaps can be found in Mandiant’s Targeted Logging and Detection Controls for Salesforce . What You Need in Place Before Logging Entitlement check (must-have) Most security-relevant Salesforce logs are gated behind Event Monitoring , delivered through Salesforce Shield or the Event Monitoring add-on. Confirm you are licensed for the event types you plan to use for detection. Choose the collection method that matches your operations Use real-time event monitoring (RTEM) if you need near real-time detection. Use event log files (ELF) if you need predictable batch exports for long-term storage and retrospective investigations. Use event log objects (ELO) if you require queryable history via Salesforce Object Query Language (often requires Shield/add-on). Enable the events you intend to detect on Use Event Manager to explicitly turn on the event categories you plan to ingest, and ensure the right teams have access to view and operationalize the data (profiles/permission sets). Threat Detection and Enhanced Transaction Security If your environment uses Threat Detection or ETS , verify the event types that feed those controls and ensure your log ingestion platform doesn’t omit the events you expect to alert on. What to Enable and Ingest into the SIEM Authentication and access LoginHistory (who logged in, when, from where, success/failure, client type) LoginEventStream (richer login telemetry where available) Administrative/configuration visibility SetupAuditTrail (changes to admin and security configurations) API and export visibility ApiEventStream (API usage by users and connected apps) ReportEventStream (report export/download activity) BulkApiResultEvent (bulk job result downloads—critical for bulk extraction visibility) Additional high-value sources (if available in your tenant) LoginAsEventStream (impersonation / “login as” activity) PermissionSetEvent (permission grants/changes) SaaS Pivot Logging Threat actors often pivot from compromised SSO providers into additional SaaS platforms, including DocuSign and Atlassian. Ingesting audit logs from these platforms into a SIEM environment enables the detection of suspicious access and large-scale data exfiltration following an identity compromise. What You Need in Place Before Logging You need tenant-level admin permissions to access and configure audit/event logging. Confirm your plan/subscriptions include the audit/event visibility you are trying to collect (Atlassian org audit log capabilities can depend on plan/Guard tier; DocuSign org-level activity monitoring is provided via DocuSign Monitor). API access (If you are pulling logs programmatically): Ensure the tenant is able to use the vendor’s audit/event APIs (DocuSign Monitor API; Atlassian org audit log API/webhooks depending on capability). Retention reality check: Validate the platform’s native audit-log retention window meets your investigation needs. What to Enable and Ingest into the SIEM DocuSign (audit/monitoring logs) Authentication events (successful/failed sign-ins, SSO vs password login if available) Administrative changes (user/role changes, org-level setting changes) Envelope access and bulk activity (envelope viewed/downloaded, document downloaded, bulk send, bulk download/export where available) API activity (API calls, integration keys/apps used, client/app identifiers) Source context (source IP/geo, user agent/client type) Atlassian (Jira/Confluence audit logs) Authentication events (SSO sign-ins, failed logins) Privilege and admin changes (role/group membership changes, org admin actions) Confluence/Jira data access at scale: Confluence: space/page view/download/export events (especially exports) Jira: project access, issue export, bulk actions (where available) API token and app activity (API token created/revoked, OAuth app connected, marketplace app install/uninstall) Source context (source IP/geolocation, user agent/client type) Microsoft 365 Audit Logging Mandiant has observed threat actors leveraging PowerShell to download sensitive data from SharePoint and OneDrive as part of this campaign. To detect the activity, it is necessary to ingest M365 audit telemetry that records file download operations along with client context (especially the user agent). What You Need in Place Before Logging Microsoft Purview Audit is available and enabled: Your tenant must have Microsoft Purview Audit turned on and usable (Audit “Standard” vs “Premium” affects capabilities/retention). Correct permissions to view/search audit: Assign the compliance/audit roles required to access audit search and records. SharePoint/OneDrive operations are present in the Unified Audit Log: Validate that SharePoint/OneDrive file operations are being recorded (this is where operations like file download/access show up). Client context is captured: Confirm audit records include UserAgent (when provided by the client) so you can identify PowerShell-based access patterns in SharePoint/OneDrive activity. What to Enable and Ingest into the SIEM FileDownloaded and FileAccessed ( SharePoint/OneDrive ) User agent/client identifier (to surface WindowsPowerShell-style user agents) User identity, source IP, geolocation Target resource details 3. Detections The following detections target behavioral patterns Mandiant has identified in ShinyHunters related intrusions. In these scenarios, attackers typically gain initial access by compromising SSO platforms or manipulating MFA controls, then leverage native SaaS capabilities to exfiltrate data and evade detection.The following use cases are categorized by area of focus, including Identity Providers and Productivity Platforms. Note: This activity is not the result of a security vulnerability in vendors’ products or infrastructure. Instead, these intrusions rely on the effectiveness of ShinyHunters related intrusions. Implementation Guidelines These rules are presented as YARA-L pseudo-code to prioritize clear detection logic and cross-platform portability. Because field names, event types, and attribute paths vary across environments, consider the following variables: Ingestion Source: Differences in how logs are ingested into Google SecOps. Parser Mapping: Specific UDM (Unified Data Model) mappings unique to your configuration. Telemetry Availability: Variations in logging levels based on your specific SaaS licensing. Reference Lists: Curated allowlists/blocklists the organization will need to create to help reduce noise and keep alerts actionable. Note: Mandiant recommends testing these detections prior to deployment by validating the exact event mappings in your environment and updating the pseudo-fields to match your specific telemetry. Okta MFA Device Enrollment or Changes (Post-Vishing Signal) Detects MFA device enrollment and MFA life cycle changes that often occur immediately after a social-engineered account takeover. When this alert is triggered, immediately review the affected user’s downstream access across SaaS applications (Salesforce, Google Workspace, Atlassian, DocuSign, etc.) for signs of large-scale access or data exports. Why this is high-fidelity: In this intrusion pattern, MFA manipulation is a primary “account takeover” step. Because MFA lifecycle events are rare compared to routine logins, any modification occurring shortly after access is gained serves as a high-fidelity indicator of potential compromise. Key signals Okta system Log MFA lifecycle events (enroll/activate/deactivate/reset) principal.user , principal.ip , client.user_agent , geolocation/ASN (if enriched) Optional: proximity to password reset, recovery, or sign-in anomalies (same user, short window) Pseudo-code (YARA-L) events:
   $mfa.metadata.vendor_name = “Okta”
   $mfa.metadata.product_event_type in ( “okta.user.mfa.factor.enroll”, “okta.user.mfa.factor.activate”, “okta.user.mfa.factor.deactivate”, “okta.user.mfa.factor.reset_all” )
   $u= $mfa.principal.user.userid
   $t_mfa = $mfa.metadata.event_timestamp

   $ip = coalesce($mfa.principal.ip, $mfa.principal.asset.ip)
   $ua = coalesce($mfa.network.http.user_agent, $mfa.extracted.fields[“userAgent”], “”)

   $reset.metadata.vendor_name = “Okta”
   $reset.metadata.product_event_type in (
   “okta.user.password.reset”, “okta.user.account.recovery.start” )
   $t_reset = $reset.metadata.event_timestamp

   $auth.metadata.vendor_name = “Okta”
   $auth.metadata.product_event_type in (“okta.user.authentication.sso”, “okta.user.session.start”)
   $t_auth = $auth.metadata.event_timestamp

   match:
   $u over 30m

   condition:
   // Always alert on MFA lifecycle change
   $mfa and
   // Optional sequence tightening (enrichment only, not mandatory):
   // If reset/auth exists in the window, enforce it happened before the MFA change.
   (
   (not $reset and not $auth) or
   (($reset and $t_reset < $t_mfa) or ($auth and $t_auth < $t_mfa)) ) Suspicious admin.security Actions from Anonymized IPs Alert on Okta admin/security posture changes when the admin action occurs from suspicious network context (proxy/VPN-like indicators) or immediately after an unusual auth sequence. Why this is high-fidelity: Admin/security control changes are low volume and can directly enable persistence or reduce visibility. Key signals Okta admin/system events (e.g., policy changes, MFA policy, session policy, admin app access) “Anonymized” network signal: VPN/proxy ASN, “datacenter” reputation, TOR list, etc. Actor uses unusual client/IP for admin activity Reference lists VPN_TOR_ASNS (proxy/VPN ASN list) Pseudo-code (YARA-L) events: $a.metadata.vendor_name = "Okta" $a.metadata.product_event_type in ("okta.system.policy.update","okta.system.security.change","okta.user.session.clear","okta.user.password.reset","okta.user.mfa.reset_all") userid=$a.principal.user.userid // correlate with a recent successful login for the same actor if available $l.metadata.vendor_name = "Okta" $l.metadata.product_event_type = "okta.user.authentication.sso" userid=$l.principal.user.userid match: userid over 2h condition: $a and $l Google Workspace OAuth Authorization for ToogleBox Recall Detects OAuth/app authorization events for ToogleBox recall (or the known app identifier), indicating mailbox manipulation activity. Why this is high-fidelity: This is a tool-specific signal tied to the observed “delete security notification emails” behavior. Key signals Workspace OAuth / token authorization log event App name, app ID, scopes granted, granting user, source IP/geo Optional: privileged user context (e.g., admin, exec assistant) Pseudo-code (YARA-L) events: $e.metadata.vendor_name = "Google Workspace" $e.metadata.product_event_type in ("gws.oauth.grant", "gws.token.authorize") // placeholders // match app name OR app id if you have it (lower($e.target.application) contains "tooglebox" or lower($e.target.application) contains "recall") condition: $e Gmail Deletion of Okta Security Notification Email Detects deletion actions targeting Okta security notification emails (e.g., “Security method enrolled”). Why this is high-fidelity: Targeted deletion of security notifications is intentional evasion, not normal email behavior. Key signals Gmail audit log delete/permanent delete (or mailbox cleanup) event Subject matches a small set of security-notification strings Time correlation: deletion shortly after receipt (optional) Pseudo-code (YARA-L) events: $d.metadata.vendor_name = "Google Workspace" $d.metadata.product_event_type in ("gws.gmail.message.delete", "gws.gmail.message.trash", "gws.gmail.message.permanent_delete") // PLACEHOLDER regex_match(lower($d.target.email.subject), "(security method enrolled|new sign-in|new device|mfa|authentication|verification)") $u = $d.principal.user.userid $t = $d.metadata.event_timestamp match: $u over 30m condition: $d and count($d) >= 2 // tighten: at least 2 in 30m; adjust if too strict
   } Google Takeout Export Initiated/Completed Detects Google Takeout export initiation/completion events. Why this is high-fidelity: Takeout exports are uncommon in corporate contexts; in this campaign they represent a direct data export path. Key signals Takeout audit events (e.g., initiated, completed) User, source IP/geo, volume Reference lists TAKEOUT_ALLOWED_USERS (rare; HR offboarding workflows, legal export workflows) Pseudo-code (YARA-L) events:
   $start.metadata.vendor_name = “Google Workspace”
   $start.metadata.product_event_type = “gws.takeout.export.start”
   $user = $start.principal.user.userid
   $job = $start.target.resource.id // if available; otherwise remove job join

   $done.metadata.vendor_name = “Google Workspace”
   $done.metadata.product_event_type = “gws.takeout.export.complete”
   $bytes = coalesce($done.target.file.size, $done.extensions.bytes_exported)

   match:
   // takeout can take hours; don’t use 10m here, adjust accordingly
   $start.principal.user.userid = $done.principal.user.userid over 24h
   // if you have a job/export id, this makes it *much* cleaner
   $start.target.resource.id = $done.target.resource.id
   condition:
   $start and $done and
   $start.metadata.event_timestamp < $done.metadata.event_timestamp and $bytes >= 500000000 // 500MB start point; tune
   not ($u in %TAKEOUT_ALLOWED_USERS) // OPTIONAL: remove if you don’t maintain it Cross-SaaS Attempted Logins from Known Campaign Proxy/IOC Networks Detects authentication attempts across SaaS/SSO providers originating from IPs/ASNs associated with the campaign. Why this is high-fidelity: These IPs and ASNs lack legitimate business overlap; matches indicate direct interaction between compromised credentials and known adversary-controlled infrastructure. Key signals Authentication attempts across Okta / Salesforce / Workspace / Atlassian / DocuSign principal.ip matches IOC IPs or ASN list Reference lists SHINYHUNTERS_PROXY_IPS VPN_TOR_ASNS Pseudo-code (YARA-L) events:
   $e.metadata.product_event_type in (
   “okta.login.attempt”, “workday.sso.login.attempt”,
   “gws.login.attempt”, “salesforce.login.attempt”,
   “atlassian.login.attempt”, “docusign.login.attempt”
   )
   (
   $e.principal.ip in %SHINYHUNTERS_PROXY_IPS or
   $e.principal.ip.asn in %VPN_TOR_ASNS
   )

   condition:
   $e Identity Activity Outside Normal Business Hours Detects identity events occurring outside normal business hours, focusing on high-risk actions (sign-ins, password reset, new MFA enrollment and/or device changes). Why this is high-fidelity: A strong indication of abnormal user behavior when also constrained to sensitive actions and users who rarely perform them. Key signals User sign-ins, password resets, MFA enrollment, device registrations Timestamp bucket: late evening / friday afternoon / weekends Pseudo-code (YARA-L) events:
   $e.metadata.vendor_name = “Okta”
   $e.metadata.product_event_type in (“okta.user.password.reset”,”okta.user.mfa.factor.activate”,”okta.user.mfa.factor.reset_all”) // PLACEHOLDER
   outside_business_hours($e.metadata.event_timestamp, “America/New_York”)
   // Include the business hours your organization functions in
   $u = $e.principal.user.userid

   condition:
   $e Successful Sign-in From New Location and New MFA Method Detects a successful login that is simultaneously from a new geolocation and uses a newly registered MFA method. Why this is high-fidelity: This pattern represents a compound condition that aligns with MFA manipulation and unfamiliar access context. Key signals Successful authentication New geolocation compared to user baseline New factor method compared to user baseline (or recent MFA enrollment) Optional sequence: MFA enrollment occurs after login Pseudo-code (YARA-L) events:
   $login.metadata.vendor_name = “Okta”
   $login.metadata.product_event_type = “okta.login.success”
   $u = $login.principal.user.userid
   $geo = $login.principal.location.country
   $t_l = $login.metadata.event_timestamp
   $m = $login.security_result.auth_method // if present; otherwise join to factor event

   condition:
   $login and
   first_seen_country_for_user($u, $geo) and
   first_seen_factor_for_user($u, $m) Multiple MFA Enrollments Across Different Users From the Same Source IP Detects the same source IP enrolling/changing MFA for multiple users in a short window. Why this is high-fidelity: This pattern mirrors a known social engineering tactic where threat actors manipulate help desk admins to enroll unauthorized devices into a victim’s MFA – spanning multiple users from the same source address Key signals Okta MFA lifecycle events Same src_ip Distinct user count threshold Tight window Pseudo-code (YARA-L) events:
   $m.metadata.vendor_name = “Okta”
   $m.metadata.product_event_type in (““, ““)
   $ip = coalesce($m.principal.ip, $m.principal.asset.ip)
   $uid = $m.principal.user.userid

   match:
   $ip over 10m

   condition:
   count_distinct($uid) >= 3 Network Web/DNS Access to Credential Harvesting, Portal Impersonation Domains Detects DNS queries or HTTP referrers matching brand and SSO/login keyword lookalike patterns. Why this is high-fidelity: Captures credential-harvesting infrastructure patterns when you have network telemetry. Key signals DNS question name or HTTP referrer/URL Regex match for brand + SSO keywords Exclusions for your legitimate domains Reference lists Allowlist (small) of legitimate domains (optional) Pseudo-code (YARA-L) events:
   $event.metadata.event_type in (“NETWORK_HTTP”, “NETWORK_DNS”)
   // pick ONE depending on which log source you’re using most
   // DNS:
   $domain = lower($event.network.dns.questions.name)
   // If you’re using HTTP instead, swap the line above to:
   // $domain = lower($event.network.http.referring_url)

   condition:
   regex_match($domain, “.*(yourcompany(my|sso|internal|okta|access|azure|zendesk|support)|(my|sso|internal|okta|access|azure|zendesk|support)yourcompany).*”
   )
   and not regex_match($domain, “.*yourcompany\\.com.*”)
   and not regex_match($domain, “.*okta\\.yourcompany\\.com.*”) Microsoft 365 M365 SharePoint/OneDrive: FileDownloaded with WindowsPowerShell User Agent Detects SharePoint/OneDrive downloads with PowerShell user-agent that exceed a byte threshold or count threshold within a short window. Why this is high-fidelity: PowerShell-driven SharePoint downloading and burst volume indicates scripted retrieval. Key signals FileDownloaded/FileAccessed User agent contains PowerShell Bytes transferred OR number of downloads in window Timestamp window (ordering implicit) and min= 500000000 or count($e) >= 20) and min($ts) < max($ts) M365 SharePoint: High Volume Document FileAccessed Events Detects SharePoint document file access events that exceed a count threshold and minimum unique file types within a short window. Why this is high-fidelity: Burst volume may indicate scripted retrieval or usage of the Open-in-App feature within SharePoint. Key signals FileAccessed Filtering on common document file types (e.g., PDF) Number of downloads in window Minimum unique file types Pseudo-code (YARA-L) events: $e.metadata.vendor_name = "Microsoft" $e.metadata.product_event_type = "FileAccessed" $e.target.application = "SharePoint" $e.target.file.full_path = /\.(doc[mx]?|xls[bmx]?|ppt[amx]?|pdf)$/ nocase) $file_extension_extract = re.capture($e.target.file.full_path, `\.([^\.]+)$`) $session_id = $e.network.session_id match: $session_id over 5m outcome: $target_url_count = count_distinct(strings.coalesce($e.target.file.full_path)) $extension_count = count_distinct($file_extension_extract) condition: $e and $target_url_count >= 50 and $extension_count >= 3 M365 SharePoint: High Volume Document FileDownloaded Events Detects SharePoint document file downloaded events that exceed a count threshold and minimum unique file types within a short window. Why this is high-fidelity: Burst volume may indicate scripted retrieval, which may also be generated by legitimate backup processes. Key signals FileDownloaded Filtering on common document file types (e.g., PDF) Number of downloads in window Minimum unique file types Pseudo-code (YARA-L) events:
   $e.metadata.vendor_name = “Microsoft”
   $e.metadata.product_event_type = “FileDownloaded”
   $e.target.application = “SharePoint”
   $e.target.file.full_path = /\.(doc[mx]?|xls[bmx]?|ppt[amx]?|pdf)$/ nocase)
   $file_extension_extract = re.capture($e.target.file.full_path, `\.([^\.]+)$`)
   $session_id = $e.network.session_id

   match:
   $session_id over 5m

   outcome:
   $target_url_count = count_distinct(strings.coalesce($e.target.file.full_path))
   $extension_count = count_distinct($file_extension_extract)

   condition:
   $e and $target_url_count >= 50 and $extension_count >= 3 M365 SharePoint: Query for Strings of Interest Detects SharePoint queries for files relating to strings of interest, such as sensitive documents, clear-text credentials, and proprietary information. Why this is high-fidelity: Multiple searches for strings of interest by a single account occurs infrequently. Generally, users will search for project or task specific strings rather than general labels (e.g., “confidential”). Key signals SearchQueryPerformed Filtering on strings commonly associated with sensitive or privileged information Pseudo-code (YARA-L) events:
   $e.metadata.vendor_name = “Microsoft”
   $e.metadata.product_event_type = “SearchQueryPerformed”
   $e.target.application = “SharePoint”
   $e.additional.fields[“search_query_text”] = /\bpoc\b|proposal|confidential|internal|salesforce|vpn/ nocase

   condition:
   $e M365 Exchange Deletion of MFA Modification Notification Email Detects deletion actions targeting Okta and other platform security notification emails (e.g., “Security method enrolled”). Why this is high-fidelity: Targeted deletion of security notifications can be intentional evasion and is not typically performed by email users. Key signals M365 Exchange audit log delete/permanent delete (or mailbox cleanup) event Subject matches a small set of security-notification strings Time correlation: deletion shortly after receipt (optional) Pseudo-code (YARA-L) events:
   $e.metadata.vendor_name = “Microsoft”
   $e.target.application = “Exchange”
   $e.metadata.product_event_type = /^(SoftDelete|HardDelete|MoveToDeletedItems)$/ nocase
   $e.network.email.subject = /new\s+(mfa|multi-|factor|method|device|security)|\b2fa\b|\b2-Step\b|(factor|method|device|security|mfa)\s+(enroll|registered|added|change|verify|updated|activated|configured|setup)/ nocase

   // filtering specifically for new device registration strings
   $e.network.email.subject = /enroll|registered|added|change|verify|updated|activated|configured|setup/ nocase

   // tuning out new device logon events
   $e.network.email.subject != /(sign|log)(-|\s)?(in|on)/ nocase

   condition:
   $e

   Original: https://cloud.google.com/blog/topics/threat-intelligence/defense-against-shinyhunters-cybercrime-saas/

End of report.