UNK_OutFlareAZ: OAuth Client ID Spoofing Campaign Targeting Microsoft Entra ID
UNK_OutFlareAZ is a threat cluster that exploited OAuth client ID spoofing starting December 2025, leveraging Cloudflare infrastructure to target over 2 million…
Category: Attack Groups
MITRE ATT&CK groups, threat actors, intrusion sets and activity clusters.
GRU Unit 29155 Cyber Division
A cyber division of Russia's Main Intelligence Directorate (GRU) known for recruiting hackers and cyber specialists from Russian universities, collaborating with cybercriminals…
FSB Center 16 Cyber Actors
A unit of the Russian Federal Security Service (FSB) attributed to disruptive sabotage operations, including against Poland's energy grid. Exploits poorly configured…
Russian Intelligence Services: Cyber Espionage Operations
Russian intelligence services are systematically hijacking internet-connected IP cameras across Europe and Ukraine to spy on military logistics, transport routes, and troop…
IronWorm — Attack group profile
IronWorm was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
BlackFile — Attack group profile
BlackFile was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
Rare Werewolf — Attack group profile
Rare Werewolf was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs,…
Librarian Ghouls — Attack group profile
Librarian Ghouls was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs,…
SHELLSTORM: Large-Scale Web Shell Access Brokerage Operation
SHELLSTORM is a large-scale operation that exploited 27 CVEs in WordPress plugins to deploy web shells on over 1.4 million domains. The…
Helix: New Data Extortion Group Targeting SharePoint
Helix is a new data extortion group that emerged from the BlackFile and ShinyHunters ecosystem. It uses vishing, device code phishing, and…