Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
5 / 13 results
highperson_alertThreat ActorINC & The Gentlemen Affiliates Deploy AI-Driven Phantom Framework
INC and The Gentlemen are Russian-speaking ransomware affiliate groups operating an AI-driven intrusion ecosystem. These actors function both as intrusion and data-extortion operators and as infrastructure providers supporting multiple partners acros…
highperson_alertThreat ActorQilin and INC Ransomware Groups Exploit CVE-2026-0257 for MFA Bypass
Qilin (tracked by Unit 42 as Spikey Scorpius) and INC (tracked as Tarnished Scorpius) are financially-motivated ransomware operators actively exploiting authentication bypass vulnerabilities for initial access.
highperson_alertThreat ActorFortiBleed Campaign Linked to INC and Lynx Ransomware Operations
The FortiBleed campaign is a financially-motivated credential theft operation attributed to actors associated with the INC and Lynx ransomware groups. The campaign focuses on exploiting FortiGate devices to harvest credentials, which are subsequently…
highperson_alertThreat ActorINC and Lynx Ransomware Groups Exploit FortiBleed for Credential Theft
INC and Lynx are ransomware threat actors linked to the FortiBleed credential theft campaign. These groups operate with the primary motivation of financial gain through ransomware deployment.
highperson_alertThreat ActorINC Ransomware Expands Operations Following LockBit and BlackCat Disruptions
INC is a ransomware-as-a-service (RaaS) operation that has emerged as a major threat actor since August 2023. The group operates a multi-affiliate model, providing ransomware tooling and infrastructure to criminal partners in exchange for a share of…