Ten agencies from seven countries document how Integrity Technology Group, a Chinese company sanctioned by the US Treasury since January 2025, supplies automated scanners, botnets, hijacked VPNs and exfiltration scripts to actors linked to Flax Typhoon. Eight old vulnerabilities, five of them just added to CISA’s KEV catalogue, remain successfully exploited.
Category: CTI & OSINT
Threat analyses, actor profiles and case studies drawn from threat intelligence and open sources. Threat modelling, indicators of compromise, adversary analysis, OSINT, APT and ransomware campaigns.
CTI & OSINT, Vulnerabilities & Alerts
UAC-0277: ClickFix, smart contracts and LUNEXSTEALER
by •
Ukraine’s government incident response team describes a ClickFix campaign served from more than a hundred compromised sites and steered through a smart contract. One of its three installation chains loads a vulnerable AMD driver whose sample does not appear in the April 2026 copy of the Microsoft blocklist examined here.
CTI & OSINT, Vulnerabilities & Alerts
Oracle’s September 2026 CSPU: 673 security patches
by •
Oracle released 673 security patches on 15 September 2026, 247 of them for vulnerabilities that are remotely exploitable without authentication. Six carry the maximum score of 10.0, five of those in Fusion Middleware. TLP:CLEAR PAP:CLEAR Unlimited disclosure, no restriction on use. Published 16 September 2026 Subject Oracle, September 2026 CSPU Distribution Public Confidence…
CTI & OSINT, Practical Cybersecurity
Active Directory: the 2026 revision of the CISA guide
by •
Eighteen Active Directory compromise techniques, their Windows event identifiers, and the logging plan that has to come first.
CTI & OSINT
GreatXML: Technical and Defensive Analysis of a BitLocker Bypass via WinRE
by •
1. Executive summary GreatXML is a public proof-of-concept, released on 10 June 2026 by the researcher Nightmare Eclipse / Chaotic Eclipse / MSNightmare, claiming a BitLocker bypass. The technique abuses the Windows Recovery Environment (WinRE), the state left behind by Microsoft Defender’s Offline Scan feature, and the legitimate processing of unattended setup answer files (unattend.xml).…
CTI & OSINT, Vulnerabilities & Alerts
RoguePlanet: a new Microsoft Defender zero-day disclosed in the wake of Patch Tuesday
by •
RoguePlanet: a new Microsoft Defender zero-day disclosed in the wake of Patch Tuesday Threat Intelligence · Vulnerability June 10, 2026 · Marc-Frédéric Gomez · 6 min read Just hours after the June 2026 fixes shipped, the researcher Nightmare Eclipse published a new exploit targeting Microsoft Defender. It works against Windows systems that are already up…
CTI & OSINT
MiniPlasma: Chaotic Eclipse Reopens cldflt.sys
by •
CTI Analysis · Unpatched Windows Vulnerability MiniPlasma: Chaotic Eclipse Reopens cldflt.sys and Revives the Question of Microsoft Patch Durability A fifth uncoordinated public disclosure in six weeks, a PoC targeting the Windows Cloud Files Mini Filter Driver, and an extraordinary claim: the CVE-2020-17103 patch would not be present on fully patched Windows 11 and Windows…
CTI & OSINT
A vulnerability in the opcode cache of Zen 2 processors
by •
CTI Analysis · Disclosure Doctrine The Embargo Isn’t Dead Everywhere: What the AMD-SB-7052 Disclosure Reminds Us Seven months of embargo, no leak, successful multi-actor coordination. In the middle of a series documenting the erosion of responsible disclosure, the AMD-SB-7052 case deserves to be read for what it is: a demonstration that the classical model still…
CTI & OSINT
What AI Is Changing in Responsible Disclosure
by •
CTI Analysis · Disclosure Doctrine The Embargo Is No Longer a Protection: What AI Is Changing in Responsible Disclosure Six dnsmasq CVEs, a maintainer exhausted by the tsunami of AI-generated bug reports, and the public admission of a major doctrinal pivot. Reading a weak signal that could foreshadow the end of a model thirty years…
CTI & OSINT, Vulnerabilities & Alerts
Two Windows zero-days disclosed without coordination
by •
CTI Analysis · Critical Vulnerability BitLocker Is No Longer a Promise: What the YellowKey Case Reveals Two Windows zero-days disclosed without coordination, a researcher openly challenging Microsoft, and a phantom component in the Windows Recovery Environment whose true nature, bug or backdoor, no one can yet determine. Published May 14, 2026 Reading time 15 minutes…
