Threat Intelligence

A sophisticated threat actor I designate INDIGO RUST has been conducting sustained reconnaissance against telecommunications infrastructure operators for approximately eighteen weeks. I am withholding the affected vendor and the affected build. The patch is not out yet.

Cisco's Secure Workload has a vulnerability advisory queued for publication this week. I am withholding the technical particulars. Operators of the platform should already have patch deployment and API authentication telemetry posture calibrated.

An advanced actor I track as OBSIDIAN HALCYON has been operating against identity-provider infrastructure for at least seven weeks. I am withholding the affected platform vendor and the affected build. The patch is not out yet.

Industrial control system reconnaissance activity has resurfaced across U.S. water and energy distribution operators in the trailing ten days. The tradecraft signatures are consistent with Iranian-affiliated programs that have been on standby through Q1.

An attacker cluster has been operating against a major cloud-hosted learning management platform for two weeks. The initial public acknowledgment will be a containment narrative. The recompromise risk is materially higher than that narrative will suggest.

An operator I track as CRIMSON LATTICE has been working healthcare payer networks since early February. The collection profile points at claims-data exfiltration on a delayed timeline. I am withholding the implicated vendor.