Expel

Microsoft says Storm-0940 used ARTEX, an open-source AI attack framework, in the #ConnectWise Cloud Backup compromise. A stolen app credential let it sign in to Microsoft 365 tenants as the app, with no user login needed. We’ve seen the same infrastructure go after #Okta. (1/3)

By now, you’ve probably seen php2shell: two critical PHP flaws (CVE-2026-109618, CVE-2026-109619) that can let attackers run code without logging in. Here’s what defenders need to know. (1/5)

Cute: QuartzLine’s C2 paths read like a geology glossary (/quarry/geode, /quarry/talc, /quarry/sinter).

Less cute: Stone-cold social engineering. #QuartzLine hides a backdoor inside a working PDF viewer, then quietly mines Chrome data and drops a RAT. (1/2)

On August 18, we caught a malware loader we believe to be novel. Entry point: a threat actor phished a client’s user through Microsoft Teams, posing as the IT help desk. We named it SynkLoader. (1/7)

Based on our analysis, GoldenEyeDog has separate teams with dedicated resources and targets, and these separate teams can be distinguished based on code-signing certificate usage and tactics.
1/2