Defensive Security

An advanced actor I track as OBSIDIAN HALCYON has been operating against identity-provider infrastructure for at least seven weeks. I am withholding the affected platform vendor and the affected build. The patch is not out yet.

An operator I track as CRIMSON LATTICE has been working healthcare payer networks since early February. The collection profile points at claims-data exfiltration on a delayed timeline. I am withholding the implicated vendor.