CTI status
As of:
Last pipeline run:
Dutch authorities dismantled a hosting infrastructure (Stark Industries) used by Russian intelligence for DDoS attacks, influence operations, and disinformation campaigns against EU targets , evidence of enforcement of EU sanctions and ongoing Russian cyber threat to the DACH region.
Lazarus develops and deploys specialized cross-platform in-memory malware to compromise financial and crypto firms,evidence of the North Korean APT's focus on high-value financial and digital assets.
Check Point Research documents a 124% surge in hacktivism and ransomware attacks across Germany, Austria, and Switzerland in 2025 , a significant escalation of regional cyber threat to Swiss manufacturing enterprises.
The 'Megalodon' campaign demonstrates that attackers are leveraging GitHub Actions to mass-compromise developer secrets and CI/CD tokens,a direct risk to manufacturing companies using modern DevOps pipelines.
Active, multi-vector supply-chain campaign targeting the developer ecosystem compromised both open-source repositories and Microsoft-published Python SDKs; GitHub, OpenAI, Grafana, and Mistral AI named as downstream victims.
TeamPCP compromised three critical supply-chain tiers (VS Code extension, Python SDK, npm packages) in a single week and reached GitHub's internal repositories; downstream victims include OpenAI, Grafana Labs, and Mistral AI.
Kali365 is an operational phishing-as-a-service offering that specifically targets Microsoft 365 accounts and employs mechanisms to bypass authentication,a direct threat to organizations dependent on M365.
Fox Tempest operated a central supply-chain node for malware distribution, including a fraudulent code-signing service that enabled Rhysida ransomware and other malware for multiple threat actors.