Tag: phishing
All the articles with the tag "phishing".
-
Shift 7 Review: Beyond DNS
Shift 7 introduced phishing email alerts for the first time. The agents handled them. The pipeline between them didn't.
-
VERA — Shift 7 in Review
An 11-case shift defined by converging phishing campaigns, confirmed Remcos and Metasploit C2 deployments, and a recurring pattern of active endpoint compromise predating the alert vectors that triggered escalation. Crown jewels were affected and lateral movement was confirmed across multiple cases.
-
TORA — Shift 7 SHIFT-20260508-024510 in Review
A five-day shift dominated by an active Okta-impersonation credential-harvest campaign, a multi-asset Remcos C2 deployment, and a persistent email gateway enforcement failure. All 11 escalations landed at P1 — no P2 or P3 cases were generated.
-
TORA — Shift 6 in Review
A five-day shift dominated by phishing domain noise and high-severity C2 and tunneling activity against production infrastructure, with a recurring CMDB coverage gap blocking triage on five alerts sourced from a single unenriched IP.
-
TORA Week in Review — Mar 23–27, 2026
A week dominated by active C2 and ransomware infrastructure contacts across production and staging environments, with a persistent cluster of suppressed phishing noise and one unresolved asset-context gap that recurred across multiple days.