ntds.dit

• Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite

  Snow Flurries: How UNC6692 Employed Social Engineering to Deploy a Custom Malware Suite Written by: JP Glab, Tufail Ahmed, Josh Kelley, Muhammad Umair Introduction Google Threat Intelligence Group (GTIG) identified a multistage intrusion campaign by a newly tracked threat group,

• vSphere and BRICKSTORM Malware: A Defender's Guide

  vSphere and BRICKSTORM Malware: A Defender's Guide Written by: Stuart Carrera Introduction Building on recent BRICKSTORM research from Google Threat Intelligence Group (GTIG), this post explores the evolving threats facing virtualized environments. These operations directly targ

• Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape

  Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape Written by: Bavi Sadayappan, Zach Riddle, Ioana Teaca, Kimberly Goody, Genevieve Stark Introduction Since 2018, when many financially motivated threat actors began shifting their moneti

• Thus Spoke…The Gentlemen

  Thus Spoke…The Gentlemen Key Points Introduction The Gentlemen ransomware‑as‑a‑service (RaaS) operation is a relatively new group that emerged around mid‑2025. Its operators advertise the service across multiple underground forums, promoting their ransomware platform and invitin

• Proactive Preparation and Hardening Against Destructive Attacks: 2026 Edition

  Proactive Preparation and Hardening Against Destructive Attacks: 2026 Edition Written by: Matthew McWhirt, Bhavesh Dhake, Emilio Oropeza, Gautam Krishnan, Stuart Carrera, Greg Blaum, Michael Rudden UPDATE (March 13): Added guidance around abuse or misuse of endpoint / MDM platfo

• IR Trends Q1 2026: Phishing reemerges as top initial access vector, as attacks targeting public administration persist

  IR Trends Q1 2026: Phishing reemerges as top initial access vector, as attacks targeting public administration persist Phishing reemerged as the most observed means of gaining initial access, accounting for over a third of the engagements where initial access could be determined

All reports →

• Connector · intel_report_ingest7