CTI status
As of:
Last pipeline run:
An actively exploited authentication bypass in PAN-OS GlobalProtect enables unauthorized VPN access; while Palo Alto is not in Joel Traber's stated stack, any manufacturing company using Palo Alto firewalls for remote access must treat this as an immediate remediation priority.
Russian intelligence services are establishing shell companies and recruiting intermediaries to systematically acquire Western manufacturing equipment, machine tools, and dual-use technology,a direct threat to European industrial enterprises and their supply chains.
Active campaign using dependency confusion against developer environments: threat actors with Russian email addresses register spoofed scoped npm packages mimicking internal corporate namespaces to deploy reconnaissance payloads.
UNC6671 uses vishing and adversary-in-the-middle techniques to bypass MFA, compromise Microsoft 365 and Okta, and exfiltrate data for extortion; the recent shutdown of their data leak site may signal a rebranding rather than cessation of operations.