Warlock, the group Microsoft tracks as Storm-2603, hit four organizations in Spanish- or Portuguese-speaking countries in two months, Symantec says. It works like the Chinese state groups it first appeared beside and extorts like a ransomware crew.
Perspective Coverage
6 publishers
- Builder
- Builder 32%
- Operator
- Operator 59%
- Investor
- Investor 9%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+15
- Incentives30
- Confidence68
buildOne report1 publisher Warlock operators ran an EDR killer on at least 40 machines within two hours
Symantec says Warlock operators ran an AV/EDR killer across at least 40 machines in roughly two hours after a suspected SharePoint compromise. The ransomware payloads moved between domain controllers through SYSVOL replication.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence55
Ontinue says the Python implant takes tasking from SharePoint dead drops over Graph API, relays interactive sessions through Teams TURN, and moves all of it through the victim's own headless Edge.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+20
- Incentives40
- Confidence60
Twelve of the thirteen pigments in the Domitian portrait were available to Leonardo and Titian. The thirteenth is Prussian blue, first produced in the early 1700s, and it sits in the laurel wreath and in a jewel on the sword hilt.
Reality
- Evidence74
- Adoption
- Not scored
- Hype gap+25
- Incentives58
- Confidence70
One console, two businesses: Broadcom says Jewelbug runs espionage and crypto fraud together
Broadcom's Threat Hunter Team says the same small team, the same infrastructure and one control panel serve both Chinese state espionage and a crypto-fraud sideline. Actor-type triage does not survive that.
Reality
- Evidence58
- Adoption68
- Hype gap+12
- Incentives62
- Confidence55