Security Insights
Latest threat analysis, industry news, and security best practices from our expert team.
Storm-0940 ConnectWise Supply Chain Attack: Detecting and Containing AI-Accelerated ScreenConnect Compromise Across 2,200+ Tenants
Introduction Microsoft Threat Intelligence has publicly attributed a large-scale ConnectWise supply chain attack to Storm-0940, a China-link...
Google Infrastructure Trust-Proxy Phishing Campaign + ScreenConnect Delivery: OTX Pulse Analysis — Enterprise Detection Pack
Google Infrastructure Trust-Proxy Phishing Campaign + ScreenConnect Delivery: Enterprise Detection Pack Threat Summary A new AlienVault OTX ...
RMM Tool Abuse in the Wild: Detecting and Blocking Unauthorized Remote Access Software After ScreenConnect Campaigns
Introduction The SANS Internet Storm Center is tracking a sustained and growing trend that every SOC needs to take seriously: threat actors ...
MSP360 RMM Abused to Deploy ScreenConnect: Detection and Response Guide for Dual-RMM Social Engineering Attacks
Introduction Microsoft has issued a warning about an active social engineering campaign in which threat actors distribute a legitimate MSP36...
ConnectWise ScreenConnect Under Active Exploitation: CISA-Confirmed Detection and Remediation Guide
Introduction CISA has confirmed what many of us in incident response have been watching build on the ground: a critical-severity vulnerabili...
CVE-2026-42016 and 4 More: CISA KEV Adds Actively Exploited JFrog Artifactory, ScreenConnect, and MikroTik RouterOS Flaws — Detection and Remediation Guide
Introduction CISA has added five vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known ...
Rogue ScreenConnect Clients Spread Four-Stage VBScript Worm: Detection and Remediation Guide
Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts Threat actors are turning one of the most common legit...
THEGENTLEMEN Ransomware: Aggressive Multi-Vector Campaign Exploiting Perimeter & RMM Flaws
Threat Actor Profile — THEGENTLEMEN Aliases & Operations THEGENTLEMEN emerged in early 2025 as a "Next-Gen" RaaS operation distinguishing it...
GENESIS Ransomware: 3 New Victims Posted — US/DK Tech & Manufacturing Sector Attack
GENESIS Ransomware Gang: 3 New Victims Posted — Sector Targeting Analysis & Detection Rules Intelligence Briefing Date: August 2, 2026 Sourc...