The n0n extortion crew hit 23 organizations across 14 countries using stolen and weak credentials — RDP scanning and FortiGate VPN credential stuffing — rather than exploits, pairing AI-assisted scripting with conventional intrusion and spending over $7,000 on AI services. They escalated to deleting data and backups and altering firewall policies, exposed their own infrastructure, and at one point misused an AWS key to wipe S3 data (The Register).
· AI Inside the Intrusion
September 26, 2026
TeamFiltration campaign hits Microsoft 365 with default passwords. Proofpoint tracks UNK_CondorFiltration, which targeted more than 5,700 accounts across 28 tenants from 1,487 unique AWS EC2 source IPs, compromising 7 accounts — primarily at Chilean retail and financial institutions (The Hacker News).
· Cloud, CI/CD & Identity
August 13, 2026
An Akira affiliate rebooted a victim into Safe Mode to strip EDR before encrypting — then broke its own encryptor in the process. The intrusion started with a VPN credential-spray, and defenders should watch for Safe Mode and boot-configuration changes alongside MFA enforcement, per The Register and SC Media.
· Threat Activity
July 10, 2026
Huntress reports an attacker made 81 million login attempts against Microsoft accounts in two weeks; 78 accounts fell — all with MFA enabled but misconfigured, a reminder that MFA coverage ≠ MFA correctness. Huntress (X)
· Cloud & Identity
July 2, 2026
Huntress is tracking an ongoing, automated password-spray campaign against Azure CLI, abusing the OAuth ROPC flow (which bypasses MFA) from an IPv6 range (2a0a:d683::/32) attributed to LSHIY LLC / AS32167 and linked to China. Over 81 million login attempts between June 12–26 compromised at least 78 Microsoft accounts across ~64–78 orgs. Recommended mitigations: enforce comprehensive MFA and block ROPC. Huntress, BleepingComputer.
· Cloud & Identity