Halloween might be the spookiest day in October but this month's Patch Tuesday is a close second. 175 new CVEs from Microsoft, 8 marked critical, 6 zero-days, 2 already exploited in the wild. But not to fear, our threat intel team breaks down the 3 you should patch first. expel.com/blog/patch-t...

We encountered a unique variant of the ClickFix malware technique. The catch? The user is social engineered into running a PowerShell script which downloads no files, makes no web requests, and embeds no payload. Regardless, it's still able to install a malicious loader. expel.com/blog/cache-s...

⚠️ Our threat intel team just caught attackers using a clever new trick to bypass security tools: cache smuggling. Instead of downloading malware, they hide it in fake images that browsers automatically cache. Then PowerShell extracts and runs it—no web requests needed.

The security industry is drowning in threat feeds that don't actually help you stop attacks. We've been working to fix that for years. Today, we’re taking the wraps off our expanded threat intel program: Expel Intel. (1/7)

50k events/day. 0.1% true positive rate. 50 real threats buried. That's what happens when you optimize for integration count, not detection quality. Vendors brag about "300+ integrations" while analysts burn out investigating false positives. Start counting what matters: expel.com/blog/stop-co...

Your email security quarantined the malicious email. 🚨📧 Victory, right? Not quite so. Several employees already clicked the link and installed attacker-controlled tools.

Chinese threat actors were building a network of SOHO routers and marking their territory with TLS certs that spoofed the LAPD. Our threat hunters found them anyway. 🕵️

⚠️ We’ve recently witnessed new activity in the realm of potentially unwanted programs (PUPs), which are dropping malware, executing commands, and turning your machine into someone else's proxy network. Read our ongoing investigation here: expel.com/blog/you-don...

🚨 A NEW trojan on the block spotted by our threat intel team 👀 We saw files with the code-signing signature “GLINT SOFTWARE SDN. BHD.” due to a JavaScript dropping “ManualFinder” One of their signed files, a PDF editor, turns your device into a residential proxy—ew. 🧵👇

⚠️ We’ve noticed a campaign leveraging SEO poisoning to drop a small loader. If you’ve seen the lure in the watering hole, we’d love to know. A copy of the malware can be found on VirusTotal as MD5 hash 6af56c606b4ece68b4d38752e7501457. Here’s what we’re seeing 🧵

What Fortune 100s are getting wrong about cybersecurity hiring 📖 Read more: www.helpnetsecurity.com/2025/07/17/c... #cybersecurity #cybersecuritynews #burnout #certification @expelsecurity.bsky.social

Spotted in NYC ❎👀 Took cloud security so seriously we actually ended up in the clouds. ☁️ Thanks for having us, Nasdaq!

⚠️ We’ve been keeping a close eye on the US-Israel-Iran geopolitical situation. Many resources are providing a ton of information and data but not a lot of analysis. Our take: things are not likely to intensify in the cyber realm. Here's what to do and what Expel is doing:

📂💥 When a malicious file hits your environment, every second counts. Expel's “delete malicious file” response action enables our SOC to permanently remove a confirmed malicious file directly from an affected host, using the EDRs and security tools you already have. expel.com/blog/explore...

⚠️🕷️ Scattered Spider is acting with a heightened amount of activity. We're seeing them pivot from credential harvesting to directly targeting IT help desks, using social engineering to reset passwords and bypass MFA. Get the full 411 on Scattered Spider's heightened activity:

It’s Patch Tuesday! 🩹 This month, Microsoft released 66 CVEs including CVE-2025-33053 and CVE-2025-33070. Of the vulnerabilities, here are the three that caught our eye as the highest priority due to the vulnerability exploitation risk factors 👀🚨 expel.com/blog/patch-t...

You’ve invested in your SIEM, now our goal is to make that investment 𝘸𝘰𝘳𝘬. We’re doubling down on our position as a leader in MDR flexibility by announcing the expansion of our SIEM coverage. We’ve launched advanced support for Palo Alto Networks Cortex XSIAM this month. 👏

Acquisitions happen. But when your security vendor gets bought out, it's not just business as usual. Are you ready to ask the hard questions? Because you need to. Our CSO Greg Notch lays out the 5 questions you need to ask when your security vendor gets acquired: expel.com/blog/5-quest...

In 7 minutes you can... 🏃 run a darn good mile 🤳 doom scroll before your next meeting 🖥️ or onboard Expel That's right. The onboarding even includes time to validate the connection within Expel Workbench™ and to test the connection. Watch the full demo and follow along! expel.com/blog/how-to-...

🎭 Identity is your new perimeter in cybersecurity. Today, hackers aren’t just breaking in, they’re logging in. In financial services, trust is everything. Your customers and employees need to securely access your services from anywhere.

Expel's contain host auto remediation allows our SOC analysts—with your pre-approval—to automatically isolate a compromised or suspicious endpoint from your network. Learn: ⚙️how our contain host auto remediation works 👟how our analysts kick off this action 🖥️how to set it up

In media (and cloud) we trust 🫡 Join Pierre Noel on 3rd June at #Infosec2025 for insights on overcoming common cloud transformation challenges in a changing digital media ecosystem. And don't forget to come see us at stand C85 for custom AI portraits and swag. expel.com/infosecurity...

🕷️Operation Endgame just announced disruption of the infrastructure behind Lactrodectus malware, a malware used by ransomware actors to gain access to enterprise networks. But the devs are persistent so we expect them to return. Here are the most recent tactics we've seen: expel.com/blog/followi...

Mergers and acquisitions can fuel growth but they also create opportunities for cyber threats. Join Expel's experts along with Visa's Ilaiy Elangovan on June 5 for a discussion on expanding your org—without slowing down the deal. 🏦🛡️ Register now: expel.com/webinars/ma-...

New blog series alert! 🔦 Follow along as we explore all of Expel’s auto remediations. In this post, we'll focus on the kill process auto remediation, which enables Expel's SOC to immediately terminate malicious processes across endpoints. Here's how it works and how to set it up:

Now that we're (a bit more) recovered from #RSAC, we wanted to take a minute to highlight the key themes we saw this year. 🧠AI—who’s using it & how 🗺️Geopolitical shifts & its impact on cybersecurity 💭Changes in corporate expectations 💡How all of this is shaping new tech expel.com/blog/recappi...

Identity has become the new frontline in cybersecurity. 🪪 🎥 In this interview with ISMG at #RSAC 2025, our CEO Dave Merkel shares why threat actors are prioritizing identity-based attacks and what security leaders should ask when evaluating AI-enabled tools. www.databreachtoday.com/identity-new...

If you're one of the many orgs that consolidated their security tools around @microsoft.com to keep costs down and now need an MDR provider to protect these new investments, you're in the right place. 🍀 Learn how Expel MDR works seamlessly with your Microsoft environment: expel.com/blog/simplif...

When it comes to any kind of addition to your tech stack, there’s always a lingering question: to build or to buy? 🤔 Do you challenge yourself to find and build it in-house or look for an MDR service provider to partner with?

In previous Quarterly Threat Reports, we focused on trends in malware & what our SOC is seeing. For our latest QTR, we focused on attack surface types to create a more tactical approach. However, we still have great data on malware trends we want to share—so here’s the 411: expel.com/blog/mdr-ins...

☁️🔒 Cloud security is seriously complex. So we created Cloud Decoded, a three-part blog series designed to demystify cloud security. In the first post, we tackle some of the most common cloud security misconceptions and shed light on what securing the cloud really means: expel.com/blog/cloud-d...

MDR services have become a cornerstone of many security strategies. As a CISO, you’re likely evaluating these offerings but are you seeing the complete financial picture? 🖼️💰 We're decoding MDR pricing models and unpacking what you need to know: expel.com/blog/mdr-pri...

And with that, #RSAC 2025 comes to an end. 😌 A time was 𝙝𝙖𝙙 at the Expel booth all week long! To everyone who stopped by our booth to chat and see what Expel MDR is all about, thank you. 💚 We couldn't have asked for a better experience. 'Til next time! 👋

"Put these on and pose." 😎🕺 Shout out to everyone who stopped by our booth at #RSAC and partook in all the fun. 💚 Booth S#0535 is still where the party's at so come on by!

How is it already the last day of #RSAC? 🥹 Make sure you don't miss us at booth S#0535 before we close shop at 2pm! 💻 Discover our 130+ tech integrations 🦸 Meet the SOC analysts that are delivering an unbeatable 17-min MTTR 👕 Last chance to grab Expel swag 📸 Get your personalized AI hero portrait

📢 And now, a quick message from Colleen Leary, our in-house swag connoisseur, at #RSAC. Stop by our booth S#0535 to learn more about our unparalleled 17-minute MTTR from our SOC analysts and grab a custom hat before you go! 🧢✨

❎ marks the spot! Our doors are officially open for day 3 of #RSAC at booth S#0535! 🚪🎊

We’re all smiles at #RSAC booth S#0535! We hear it’s because everyone learned about our industry-leading 17-minute MTTR. ⏱️ Come hang with us and see how we do it! 👋

On April 30, our threat intel team will be discussing two of the biggest cybercrime groups making waves: 🕷️ Scattered Spider and 🦁 Atlas Lion. Join us for this LinkedIn Live at 11:30am PT where our experts will share the novel techniques these groups are using, real-world case studies, and more.

A lil recap of our QTR blog series: Pt I: our top takeaways with Q1 by the numbers Pt II: looked at how attackers are leveraging cloud-based services Pt III: talked about the endpoint attack surface In part IV, we explore trends & insights for cloud infrastructure trends☁️ expel.com/blog/expel-q...

So far in our Quarterly Threat Report blog series, we: 💡 shared top takeaways from Q1 2025 in part I ☁️ dug deeper into cloud-based service incident trends in part II In part III, we look at general trends on endpoint activity & the continued threat of infostealing malware. expel.com/blog/expel-q...

Heroes don’t fight alone 🦸‍♂️🦸‍♀️ Expel helps security teams detect and respond to threats faster so they can focus on what matters most. Meet us at #RSAC booth #0535 and never fight threats alone again. expel.com/rsac-2025/?u...

In part I of our Quarterly Threat Report blog series, we broke the attack surfaces we monitor into 3 defensive fronts: ☁️ cloud-based services 🛡️ endpoint ☁️ cloud infrastructure In part II, we’ll take a closer look at cloud-based services: expel.com/blog/expel-q...

✨Out now: Expel's Quarterly Threat Report for Q1 2025! Our QTRs summarize the attacks we’re seeing over the quarter & recommend ways to protect your org. This quarter, we’re exploring specific attack surface types to give you a new vantage point into our data. Read part I: expel.com/blog/expel-q...

You've got (more secure) mail! 🔒📧 We're excited to announce Expel MDR for email, a major expansion of our service to proactively defend one of the most dangerous threat vectors: email.

Staying ahead of cyber threats requires a proactive approach for threat detection & hunting 🛡️ On May 7, join Expel's Ansh Patnaik & Forrester's Jeff Pollard to hear: ✔️ how threat hunting works in parallel to detection ✔️ threat hunting & detection engineering trends RSVP: expel.com/webinars/for...

🎉 Expel has officially been named a Trusted Cloud Provider by the Cloud Security Alliance (CSA), and we've also joined CSA as a member! This is further confirmation of what we already know—Expel isn’t just another vendor but a committed, proven partner in cloud security. ☁️🔑 expel.com/blog/expel-n...

⚠️ On Apr 15, news broke that funding for the globally relied upon CVE program was set to expire on Apr 16, 2025. Hours before the deadline, CISA announced the US gov't had extended funding. This extension puts the fire out—for now. Here's why this matters & what's next: expel.com/blog/securit...

💳 Visa wanted an MDR solution that made its tech investments—over 120 specialized security tools—work harder in order to increase visibility into its M&A security posture. 🧰 With 130+ tech integrations across 8 attack surfaces, Expel was the perfect match. Read more: expel.com/customers/vi...

Last week, in part I of 'Observing Atlas Lion,' we covered how the cybercrime group enrolled attacker-controlled virtual machines into an organization’s domain, but was stopped. expel.com/blog/observi...