ReliaQuest stories
Ransomware activity stayed elevated in Q2, with 2,252 named victims and The Gentlemen overtaking Qilin to top the rankings.
Account takeovers are becoming harder to stop as attackers use real-time code theft and fake login pages to bypass Microsoft 365 MFA.
Businesses face a fresh wave of identity theft-driven extortion as Helix is linked to BlackFile and ShinyHunters through shared infrastructure.
The tactic now reaches Mac users, as attackers turn to trusted tools and social engineering to evade defences and steal credentials.
Existing phishing and fraud tactics are becoming faster, cheaper and harder to detect, raising the risk for large organisations, ReliaQuest said.
Trusted third-party access has let attackers quietly pull large volumes of Salesforce records from enterprise systems via a Klue integration.
Older, internet-facing IIS servers are being singled out by China-linked hackers, with one new cluster able to persist despite partial containment.
Patching alone has left some older SonicWall devices exposed to VPN attacks, with reliaQuest finding the first known in-the-wild use of CVE-2024-12802.
Corporate users can be compromised in under five minutes when attackers pose as help-desk staff in external Microsoft Teams chats, researchers say.
The attack kept retrying for hours after network blocks, as a scheduled task and Python proxy preserved access on the host.
Leak-site noise is making it harder for firms to tell real breaches from extortion theatre, as active sites hit 91 in the first quarter of 2026.
Senior staff are increasingly in the crosshairs as suspected former Black Basta affiliates use Teams impersonation to seize remote access.
Trusted software and identity sessions are now prime attack paths, with ClickFix linked to more than 44% of defence evasion incidents.
Businesses face credential theft and reinfection risks as DeepLoad hides inside trusted Windows processes and evades routine clean-up.
Corelight launches Agentic Triage, an AI-driven workflow to speed SOC investigations while exposing every step for transparent review.
Ransomware group LeakNet adopts ClickFix lures and a Deno-based fileless loader to scale attacks and evade traditional endpoint defences.
ShinyHunters shifts to subdomain-brand phishing and vishing on mobiles, bypassing domain checks to hijack SSO logins and SaaS sessions.
AI-fuelled hackers can now spread across corporate networks in as little as four minutes, outpacing human defenders by hours.
China-linked Warlock ransomware group exploits SmarterMail flaw for admin takeovers, chaining features to gain full Windows control.
Florida State University will expand AI cyber training and research after a USD $1.5 million gift from ReliaQuest to fund new student and faculty programmes.
