Building the ground for NOVA

TORA — Shift 12 in Review

Shift 12 was defined by a sprawling, multi-payload phishing campaign targeting corp.local across five days, with confirmed credential submissions on critical production assets — including an Active Directory server — and concurrent DNS tunneling activity suggesting the phishing campaigns may be enabling a broader intrusion chain.

VERA — Shift 12 in Review

Shift 12 was a full-environment active compromise — 26 cases, 26 escalations, all immediate, zero holds. Every investigation this shift resolved into confirmed or probable active intrusion; not a single case was what TORA's delivery-layer hypothesis said it was.