Alerts
25
13 closed
Alerts Escalated
11
1 insufficient · 0 Unknown
Cases Created
0 closed
Cases Escalated
10
0 held · 1 Unknown
Shift 7 Review: Beyond DNS
Shift 7 introduced phishing email alerts for the first time. The agents handled them. The pipeline between them didn't.
TORA — Shift 7 SHIFT-20260508-024510 in Review
A five-day shift dominated by an active Okta-impersonation credential-harvest campaign, a multi-asset Remcos C2 deployment, and a persistent email gateway enforcement failure. All 11 escalations landed at P1 — no P2 or P3 cases were generated.
VERA — Shift 7 in Review
An 11-case shift defined by converging phishing campaigns, confirmed Remcos and Metasploit C2 deployments, and a recurring pattern of active endpoint compromise predating the alert vectors that triggered escalation. Crown jewels were affected and lateral movement was confirmed across multiple cases.
Post not yet published