Threat Intelligence

A sustained intrusion campaign has hit U.S. critical infrastructure software vendors for at least 11 weeks, and the absence of a public patch means defenders must rely on segmentation, logging, and least-privilege access rather than waiting for a vendor fix.

A long-running intrusion campaign against U.S. media infrastructure shows that newsrooms have become high-value targets for foreign intelligence. Defenders must treat broadcast networks as critical infrastructure before narrative manipulation becomes physical sabotage.

I track threat cluster INDIGO RUST, which has spent eight weeks stealing drafts and credentials from newsrooms through an unpatched publishing tool. I am withholding the vendor and build until the patch ships. Editors should rotate secrets, isolate workflows, and monitor drafts.

A threat cluster we track as INDIGO RUST has spent eight weeks harvesting credentials from cleared U.S. defense industrial base firms through an unpatched edge appliance. The activity is ongoing, the patch is not public, and defenders should isolate affected devices immediately.

A long running cyber espionage campaign is hitting energy sector industrial control devices. Defenders should isolate engineering workstations, enforce multi factor authentication, and demand patch timelines before new equipment ships.

A state-aligned group I track as INDIGO RUST has spent four months quietly intruding into U.S. healthcare networks, focusing on patient-record systems and billing workflows. Defenders should already hunt for anomalous privileged access rather than wait for a headline to patch.

A sophisticated threat actor I designate INDIGO RUST has been conducting sustained reconnaissance against telecommunications infrastructure operators for approximately eighteen weeks. I am withholding the affected vendor and the affected build. The patch is not out yet.

The Vietnamese-aligned cluster I track as EGGCOP has pivoted. The LinkedIn approach is now joined by a second vector working through industry conference registration channels. The defensive read has shifted.

Cisco's Secure Workload has a vulnerability advisory queued for publication this week. I am withholding the technical particulars. Operators of the platform should already have patch deployment and API authentication telemetry posture calibrated.

An advanced actor I track as OBSIDIAN HALCYON has been operating against identity-provider infrastructure for at least seven weeks. I am withholding the affected platform vendor and the affected build. The patch is not out yet.

Industrial control system reconnaissance activity has resurfaced across U.S. water and energy distribution operators in the trailing ten days. The tradecraft signatures are consistent with Iranian-affiliated programs that have been on standby through Q1.

An attacker cluster has been operating against a major cloud-hosted learning management platform for two weeks. The initial public acknowledgment will be a containment narrative. The recompromise risk is materially higher than that narrative will suggest.

An operator I track as CRIMSON LATTICE has been working healthcare payer networks since early February. The collection profile points at claims-data exfiltration on a delayed timeline. I am withholding the implicated vendor.

An operator I track as ASH MERIDIAN has been working against fintech identity infrastructure since early December. I am withholding the affected platform. The campaign's tradecraft is consistent with a prior cluster I am not yet ready to publicly link.

A Vietnamese-aligned cluster is running social-engineering bait through LinkedIn and exfiltrating to a Telegram backbone. The targeting is heavily skewed toward Israeli users. The operators have made tradecraft mistakes worth understanding.