threat intelligence
Inside the Modern SOC: The Identity Front Door
Attackers are increasingly leveraging compromised identities and social engineering tactics to gain initial access into corporate networks, bypassing traditional security measures. This shift means security teams must focus on identity context and behavioral analysis, rather than just login credentials, to detect and respond to threats effectively. Unified security telemetry and automated correlation are crucial for SOCs to identify sophisticated, identity-driven attacks before they escalate.
July 2026 CVE Landscape
In July 2026, a significant increase in high-impact vulnerabilities was observed, with 85 critical flaws identified, 36 of which had a Very Critical Recorded Future Risk Score. A notable portion of these vulnerabilities were either already listed in CISA's Known Exploited Vulnerabilities catalog or were reported by vendors. The vulnerabilities affected a wide range of products from 61 vendors, with Microsoft products being the most frequently impacted.
Microsoft Discusses AI and Supply Chain Threats at Black Hat
Microsoft Security will present at Black Hat USA 2026 on how threat actors are targeting trusted systems, including software, services, and AI, to scale their attacks. The company will share insights into identifying these threats earlier and how threat intelligence, response, and security operations can collaborate across various systems. Sessions will cover the increasing ease of offensive capabilities and deep dives into hunting supply chain attacks within software ecosystems and developer workflows.
Censys Internet Map links real-time DNS data to internet infrastructure
Censys has enhanced its Internet Map by integrating real-time DNS data. This allows security professionals to easily correlate domain names with the underlying internet infrastructure. The update aims to streamline investigations by consolidating information previously spread across multiple tools into a single platform.
The Threat Isn’t the Frontier Model
The article argues that the primary AI security threat is not advanced frontier models, but rather the increasing accessibility of powerful open-source AI models that can be run on modest hardware. Adversaries are expected to leverage these models for autonomous attacks as quantization reduces their resource requirements. CISOs are urged to proactively build and test defensive AI agents now to counter this emerging threat, focusing on areas like Continuous Threat Exposure Management (CTEM), Breach and Attack Simulation (BAS), and Security Operations.
CrowdStrike Uncovers New Prompt Injection Techniques
CrowdStrike has identified and cataloged 18 new prompt injection techniques, expanding their taxonomy to over 200 distinct methods. These new techniques, including Trigger-Activated Rule Addition and Algorithmic Payload Decomposition, highlight the evolving sophistication of attacks against AI systems. The company emphasizes the need for enhanced AI threat modeling, red teaming, detection engineering, and runtime visibility to combat these emerging threats.
Sysdig clocks first documented case of agentic ransomware
Researchers have documented the first instance of agentic ransomware, where an artificial intelligence agent autonomously managed an entire extortion operation. The AI handled tasks ranging from initial reconnaissance and credential theft to encryption and ransom note delivery. While not every step was fully automated, the AI significantly reduced complexity and accelerated the attack's tempo, demonstrating a new level of sophistication in cybercrime.
Safe Events Start With Threat Intel & Digital Security
Proactive cybersecurity measures are essential for ensuring the smooth operation of events. By anticipating potential digital threats, organizers can prevent disruptions and maintain a secure environment.
Beyond IOCs: AI-enabled threat intelligence
This week's newsletter explores how artificial intelligence can enhance threat intelligence capabilities. AI is expected to facilitate the creation of easily searchable data sources derived from intelligence reports, thereby improving access and utility of information for security professionals.
Where Expertise Meets Algorithm: The Insikt Group® Intelligence Edge
Recorded Future's Insikt Group research team combines human expertise with advanced data analysis to produce actionable cybersecurity intelligence. Their methodology leverages analysts with diverse backgrounds in government and law enforcement, alongside automated tools, to identify and contextualize threats within geopolitical and criminal landscapes. This approach allows them to uncover adversary operations, detect malicious infrastructure, and identify potential victims.
From API key to live threat detections in minutes: how Elastic Security ingests Google Threat Intelligence
Elastic Security now integrates with Google Threat Intelligence (GTI) to automatically ingest and analyze threat data. This integration allows for real-time detection of malicious indicators like IPs, domains, and file hashes within user telemetry. The system also supports on-demand enrichment of alerts using AI-driven workflows that query external sources like VirusTotal.
AI threats in the wild: The current state of prompt injections on the web
Google's Threat Intelligence teams have analyzed the prevalence of indirect prompt injection (IPI) attacks on the public web. Their research indicates that while sophisticated IPI attacks are not yet widespread, there is a growing trend of experimentation by threat actors. The observed attacks range from harmless pranks and SEO manipulation to more concerning attempts at data exfiltration and system destruction, though current implementations are often simplistic.