Threat Intelligence

Patterns from our own engagements

Threat activity our teams have observed across AML, network defense, and forensics engagements — shared to help other security teams recognize the same patterns.

HighBanking

Coordinated Shell-Layering Campaign Targeting National Financial Intelligence Units

Our AML engagements across three national financial intelligence units have surfaced a shared pattern of synthetic-identity shell accounts used to layer illicit funds across jurisdictions within days rather than weeks.

Unattributed (tracked as CLUSTER-19) · 2026-06-25

MediumGovernment

Credential-Stuffing Activity Against Government Vendor Portals

We've observed a sustained increase in credential-stuffing attempts against government vendor and procurement portals, deliberately paced to stay under naive rate-limiting thresholds.

Multiple opportunistic actors · 2026-05-14

HighCritical Infrastructure

Supply-Chain Targeting of OT-Adjacent Software Vendors

We're seeing continued targeting of smaller software vendors that serve operational-technology-adjacent clients, using trojanized updates as an initial-access vector into environments with weaker direct perimeter defenses.

Suspected state-nexus (unattributed) · 2026-03-08

Seeing something similar?

If you're observing activity matching one of these patterns, or want to discuss threat intelligence sharing, reach out to our team.