Which Platforms to Use for Enterprise Threat Intelligence
A CloudSEK-focused guide says enterprise threat intelligence must filter noise and correlate exposure.
16
Vendor
CloudSEK
- Mentions · 7d0
- Mentions · 30d0
- All mentions11
- First seenAug 12, 2026
- Last mentionedSep 27, 2026
Timeline
11 articles · newest firstAttackers Abuse npm Trusted Publishing in GHAPPIER Campaign
Attackers abused npm trusted publishing to ship the GHAPPIER loader via a legitimate package in the North Korea-linked PolinRider campaign.
72
BigBear 2.0 phishing campaign hijacks Microsoft 365 sessions after MFA
CloudSEK uncovered BigBear 2.0, a PhaaS operation that captured 4,148 Microsoft 365 session cookies, hijacking authenticated sessions after MFA via AiTM proxy.
74
BigBear 2 PhaaS Campaign Steals 5000+ Microsoft Credentials
CloudSEK researchers found the BigBear 2.0 PhaaS kit, built on Evilginx2, has stolen over 5,100 Microsoft 365 credentials across 461 organizations in 40+ countries.
70
BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA With Session Cookie Theft
CloudSEK identified BigBear 2.0, an Evilginx2-based AiTM phishing operation stealing Microsoft 365 MFA session cookies, hitting 461 organizations across 40-plus countries.
74
BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
CloudSEK found the BigBear 2.0 phishing-as-a-service platform bypassed MFA at 258 organizations and captured over 5,000 Microsoft 365 credentials.
72
Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America
Unit 42 documents two AI-assisted intrusion campaigns against Latin American government, utility, and financial organizations using LLM-orchestrated tooling.
72
Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets
Aurora ransomware operators used Cursor AI running Claude Sonnet to plan and execute intrusions against dozens of organizations in nine countries.
68
Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks
Australian Federal Police charges two men with 14 offences over TeamPCP supply chain backdoors in Trivy, Checkmarx KICS, and LiteLLM affecting 1,000+ organizations.
72
Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data
CISA added actively exploited Oracle WebLogic flaw CVE-2026-21962 (CVSS 10.0) to its KEV catalog, letting unauthenticated attackers access or modify critical data.
85
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
Malicious LiteLLM 1.82.7/1.82.8 PyPI releases tied to the Trivy TeamPCP campaign harvested cloud, SSH, and database credentials, potentially exposing 2,500+ organizations.
78
Related CVEs
by mentions- CVE-2026-2196273%10.0Unauthenticated Access Control Bypass in Oracle HTTP Server and WebLogic Proxy Plug-in
- CVE-2020-14882100%9.8Remote Code Execution in Oracle WebLogic Server
- CVE-2020-255193%9.8Unauthenticated Remote Code Execution in Oracle WebLogic Server via IIOP
- CVE-2026-3363460%9.4Embedded Malicious Code in Aquasecurity Trivy, trivy-action, and setup-trivy Releases
- CVE-2017-10271100%7.5Unauthenticated Remote Code Execution in Oracle WebLogic Server
- CVE-2020-1488398%7.2High-Privilege Console Flaw in Oracle WebLogic Server Enables Full Takeover
Appears with
- CloudSEKorganization · 6
- Microsoftvendor · 4
- Microsoft 365product · 4
- General Bossthreat actor · 2
- FBIorganization · 2
- Evilginx2product · 2
- TeamPCPthreat actor · 2
- Trivyproduct · 2
- LiteLLMproduct · 2
- BigBear 2.0product · 2
- GitHub Actionsproduct · 1
- Microsoft Defenderproduct · 1
- Palo Alto Networksvendor · 1
- Aqua Securityvendor · 1
- CL-CRI-1131threat actor · 1
- Claude Sonnetproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.