Proofpoint's Emerging Threats "rule magician," Tony Robinson, is featured on this latest Discarded #podcast episode. 🪄 Listen as he shares the story behind his open-source tool, IoT Hunter, and explains how, through automation, it helps defenders cover hundreds of CVEs. brnw.ch/21wXDRr

Proofpoint is proud to have assisted law enforcement in the #OperationEndgame investigation that led to the November 13, 2025 disruption of #Rhadamanthys and #VenomRAT, both malicious infrastructure used by multiple cybercriminals. Rhadamanthys: brnw.ch/21wXsCc VenomRAT: brnw.ch/21wXsCd

Proofpoint researchers say with high confidence that cybercriminals are working with organized crime groups to commit physical cargo theft. 🚚 @bloomberg.com spoke with our #ecrime experts who warned, "It is a full-scale supply chain threat." Read the article: www.bloomberg.com/news/article....

New research from @ThreatInsight 🚨 Deviations in typical activities by known Iranian-linked threat actors has resulted in Proofpoint threat researchers naming a new temporary threat actor cluster, UNK_SmudgedSerpent. Blog: www.proofpoint.com/us/blog/thre...

From Old West train robbers 🚂 to 1960s mobsters 💰, #cargotheft is an age-old problem. Today, cargo theft is commonly conducted digitally by hacking the #supplychain to exploit gaps and steal #freight remotely. 🧵⤵️

Proofpoint threat researchers have designed an open-source tool—named PDF Object Hashing—to track and detect the unique characteristics of PDFs used by threat actors... similar to a digital fingerprint. 🫆 We use this tool internally to help track multiple threat actors with high confidence.

With the goal of better understanding cloud account takeover (#ATO) attacks, we developed a tool that automates the creation of malicious internal apps within a #compromised #cloud environment. Here, we detail our findings and security implications. ⤵️ brnw.ch/21wWOgL

Since 14 October, we’ve tracked a high volume XWorm campaign targeting Germany. The activity is attributed to TA584, a sophisticated #cybercrime group tracked since 2020. Messages are sent from hundreds of compromised sender accounts impersonating ELSTER and contain malicious URLs.

TA585 is the identifier of the most recent threat actor named by Proofpoint. The sophisticated cybercriminal, notably, appears to own its entire attack chain with multiple delivery techniques. Learn about TA585 and one of its favored payloads, MonsterV2: brnw.ch/21wWAAU.

Researchers at Proofpoint have uncovered a recent brute force campaign, tracked as UNK_CustomCloak, targeting the first-party app, Windows Live Custom Domains. Activity was observed from September 20-30th, affecting nearly half a million users in over 4,000 tenants.

Proofpoint threat researchers have published new research identifying a new cyber-espionage campaign by #TA415 (#APT41), a China-aligned threat actor, exploiting growing uncertainty in U.S.-China economic relations. Blog: www.proofpoint.com/us/blog/thre....

Threat actors continue to abuse GitHub to deliver malware, this time: #LummaStealer. We identified GitHub notification emails that kick off the attack chain. Messages are sent when the threat actor, using an actor-controlled account, comments on existing GitHub issues. 🧵

Threat actors are exploiting #Microsoft365 Direct Send to make their phishing campaigns appear to originate from inside an organization. On this episode of DISCARDED, you'll hear why legacy features like Direct Send are a prime target for cybercriminals. Stream now on our website: brnw.ch/21wVja5

Something #spicy is coming to the next Only Malware in the Building podcast—dropping September 2. 🌶️ Bookmark the show page and reserve your seat at the table 🪑 alongside Selena Larson, Dave Bittner and Keith Mularski. 🔥 You won't want to miss it! thecyberwire.com/podcasts/onl... #podcast #hotones

You asked, we answered. AI tools are significantly lowering the barrier to entry for cybercriminals. We have observed threat actor campaigns leveraging the AI-generated website builder Lovable to create and host cred phishing, malware, and fraud websites. Learn more in our blog: brnw.ch/21wV3Zo

Proofpoint identified a unique attack chain leveraging GitHub notifications to deliver #Rhadamanthys. We first spotted this post by ANY.RUN about ClickFix delivering Rhadamanthys and began investigating. infosec.exchange/@anyrun_app/...

Threat researchers from Proofpoint have found a way to sidestep FIDO-based #authentication, a discovery that could expose targets to credential phishing attacks, account takeover (#ATO), and adversary-in-the-middle (AiTM) threats. #FIDO #MFA All the details in our blog: brnw.ch/21wURuW.

In a new technical blog, Proofpoint threat researchers detailed their observations of threat actors impersonating well-known enterprises with fake #Microsoft #OAuth applications that redirect to malicious URLs, enabling credential phishing. brnw.ch/21wUA69

Each threat actor has its own tactics, techniques, and procedures (TTPs). On this DISCARDED episode, we discuss the chaotic brilliance of mid-tier eCrime actors, why shared commodity tooling can make attribution difficult, why TA582 is so interesting, and much more. Stream here 👉 brnw.ch/21wUw3L

🚨 Job seekers, watch out! 🚨 Proofpoint found threat actors targeting job seekers to distribute remote management tools that can lead to data or financial theft, or potentially to install follow-on malware like ransomware.

Threat researchers at Proofpoint released new details on a widespread Request for Quote (RFQ) scam that involves leveraging common Net financing options to steal a variety of high-value electronics and goods. Blog: brnw.ch/21wUkQ8 #shipment #RFQ #finance #scam

NEW ‼️ Researchers at @Proofpoint revealed an increase in China-aligned cyber #espionage targeting Taiwan’s #semiconductor industry—a sector critical to the global tech #supplychain. At least 3️⃣ distinct China-aligned threat actors are behind the efforts. brnw.ch/21wUctY

Confirm before you click! 🖱️ Learn about an interesting phishing campaign involving the “unsubscribe” link often included in marketing emails. 🔍 ⤵️

#Espionage 🤝 #Cybercrime TA829 🤝 UNK_GreenSec Proofpoint researchers published new insights on an intriguing overlap between 2 threat actor clusters—TA829 and UNK_GreenSec—in a campaign that blurs the lines between espionage and cybercriminal activity. brnw.ch/21wTN5x

In a new blog, Proofpoint threat research engineers disclosed their detailed discovery of Amatera Stealer, a newly rebranded and upgraded malware-as-a-service (MaaS) version of the ACR Stealer. Read the blog: brnw.ch/21wTvpI. #securityengineering #detectionengineering #securitycontrols

New ecrime insights: TA4557, known for distributing More_eggs malware, notably expanded to an international audience in recent campaigns. Per our data, the recruiter-focused TA was seen targeting orgs in France, England & Ireland, in addition to typical North America-targeted threats.

Researchers at Proofpoint expose threat actors’ attempt to hijack thousands of EntraID user accounts across almost 100 cloud tenants by leveraging TeamFiltration, a red teaming framework used by network defenders. brnw.ch/21wTk3G

We recently discovered an infostealer in our data that we originally dubbed "Aurotun," named for a misspelling of "autorun" in its strings. After collab w/ @intel471.bsky.social, @malwareindepth.com & others, we believe this malware is actually MonsterV2, a newer version of an existing infostealer.

Just published: A two-part blog series in collaboration with @threatray.bsky.social, which aims to substantiate the claim that #TA397 (Bitter) is an espionage-focused, state-backed threat actor with interests aligned to the Indian state. Part 1: brnw.ch/21wT9A5 Part 2: brnw.ch/21wT9Ad.

Today, Proofpoint joins the cybersecurity community and the U.S. and international law enforcement in celebrating the disruption of #DanaBot, a malware-as-a-service used by sophisticated cybercriminals since 2018. brnw.ch/21wSRiZ

State-sponsored threat actors often leverage techniques first developed and deployed by cybercriminal actors. One example is #ClickFix, a highly effective #socialengineering technique. Listen as our experts share how modern #espionage and #cybercrime are increasingly blurring lines. brnw.ch/21wSNbN

A new blog by Proofpoint researchers reveals Feb 2025 activity by TA406, a North Korean-aligned advanced persistent threat. #TA406 targeted government entities in Ukraine with phishing campaigns to deliver malware and harvest credentials. Read the details: brnw.ch/21wSCmF. #Konni

🚨 New threat research from @proofpoint.com 🚨 We have observed a notable increase in high-volume Japanese language campaigns targeting organizations in #Japan to deliver a phishing kit that Proofpoint researchers refer to as #CoGUI. Blog: brnw.ch/21wSrLN

Happening now at the #RSAC Moscone briefing stage: Daniel Blackford, Director of Threat Research for Proofpoint, is presenting his expert insights on the behaviors and activity of today’s financially motivated and nation-state attackers.

State sponsored threat actors in North Korea, Iran and Russia have been experimenting with a highly successful #socialengineering technique called #ClickFix. See our latest threat research blog for full details: brnw.ch/21wS4gL.

With +2M customers around the world, Proofpoint has unmatched visibility into the cyberthreat landscape. We monitor and track threat actors and their tactics, techniques and procedures, and surface these insights to customers and the community for awareness. Here’s an example ⤵️

Here's interesting cyber criminal activity to sink your teeth 🦷 into: Proofpoint researchers identified a campaign targeting dentists to deliver Braodo, a Python-based info stealer. Messages claimed to be asking for help from a dentist (the sender wants porcelain teeth) and included a Dropbox URL.

Proofpoint also recently observed this activity delivering GootLoader. Google Ads for a fake document creation app (lawliner[.]com) led to a malicious document creation website, on which users are directed to enter their email address.

Proofpoint researchers have identified two active #accounttakeover campaigns, tracked as UNK_PanicPulse & UNK_MistyMirror, targeting #Microsoft365 accounts. Since March 2024, both clusters have affected 6K+ accounts across 1.4K+ organizations, using botnets & unique client agents. #ATO

Threat researchers at Proofpoint are tracking two ongoing, highly targeted campaigns combining OAuth redirection mechanisms with brand impersonation techniques, malware proliferation, and #Microsoft365 themed #credentialphishing for #AccountTakeover. #ATO

New cyber threat research from Proofpoint highlights how attackers are adapting to law enforcement disruptions, leveraging trusted software to evade detection and compromise systems. This blog details our team's findings: www.proofpoint.com/us/blog/thre.... #malware #ransomware #dataloss

Proofpoint APT researchers have uncovered an email-based campaign delivering multistage polyglot malware. This campaign specifically targeted organizations in the #UAE with a distinct interest in aviation and critical infrastructure. brnw.ch/21wR6T8 Key findings 🧵⤵️

On this DISCARDED episode, we uncover real-world detection wins, explore persistent threats like #TA505 and #Emotet, and dive into the importance of instincts in cybersecurity... Because, as our guest puts it, sometimes good detection is all about the vibes. www.proofpoint.com/us/podcasts/...

New FakeUpdate malware campaigns were discovered by Proofpoint threat researchers. www.bleepingcomputer.com/news/securit... Behind the campaigns are two new cybercrime groups that are working together to distribute a new info stealer for Mac computers alongside malware for Windows & Android hosts.

With access to one of the largest, most diverse data sets in all of cybersecurity, Proofpoint is dedicated to tracking and reporting threat actors and their evolving TTPs. This research blog (brnw.ch/21wQMTw) is packed full of new cybercriminal insights including...🧵⤵️

According to Proofpoint data, 78% of companies experienced at least one ATO attempt involving an HTTP client in the second half of 2024. This blog explores the use of HTTP clients in #ATO attack chains, shedding light on the evolving tactics of threat actors. www.proofpoint.com/us/blog/thre...

Tax lures are commonly used by threat actors as people leverage various apps and services to file important business and personal finance information. Proofpoint has observed recent tax-themed malicious campaigns across the world. See our research blog for examples: ow.ly/Rbrz50UOPxv. #taxseason

As the Chief of NSA's Cybersecurity Collaboration Center, Kristina Walter is focused on scaling the NSA's collaborative partnerships with domestic companies to enhance cyber threat intel for defensive purposes. Stream DISCARDED to hear her expert insights: www.proofpoint.com/us/podcasts/....

Takedown Services Manager Hannah Rapetti helps Proofpoint customers address malicious web domains that are targeting their company. In this video, she highlights tactics employed by threat actors to trick users into thinking the content is legitimate. Stream the full episode: ow.ly/vXoP50UGz5e.

It's the most wonderful time of the year for cybercriminals. ❄️ Our researchers report that threat actors are attempting to take advantage of people’s desires for deals, jobs, and end-of-year bonuses. This blog shares real examples of these themed threats. www.proofpoint.com/us/blog/thre...