Resources & Insights

Attackers break out in 29 minutes, sometimes in seconds. SOAR playbooks were built for threats that repeat. Here's why that gap is now a CISO problem.

AI-induced incidents don't fit your IR plan, your insurance policy, or your board deck. Here's why CISOs need a new category, now.

Why a signed letter calling for global cyber defense commits to nothing, and what a real commitment from the signatories would look like.

The WindowsAudit case ended in an Israeli police arrest. How a routine file check became a nationwide investigation, and how IR work holds up as evidence.

Researchers decoded 315,320 encrypted reasoning blocks from public AI agent logs and extracted 704 secrets by replaying blocks into weaker, jailbroken models.

What Trail of Bits actually did with Google's ZKP, and how the community reconstructed the circuit from prior work.

Profero served as Jet Bank's preemptive incident response partner, deploying our Rapid-IR platform to secure Albania's first fully digital bank from day one.

A year ago we said don't panic about quantum threats. That was correct. Here's what changed, and why the window for action is now.

Claude Desktop runs its AI subprocess with --allow-dangerously-skip-permissions. What we found in the command line and what an attacker could do inside it.

AI agents now cause incidents that look like ransomware, exfiltration, and insider threats. The framework Profero uses to tell the difference and respond.

An IRGC-directed persona sabotaged industrial refrigeration and wiped disks at Israeli sites during a ceasefire. How it unfolded and how to find the actor.

A Discord bot token hardcoded in every WindowsAudit binary let Profero monitor the attacker, pull their loot dump, and identify 25+ victim organizations.

Profero IRT reverse engineered WindowsAudit.exe, a .NET 8 RAT that uses Discord as C2, runs as SYSTEM, and tears down EDR in Safe Mode.

What Anthropic's Claude Mythos release actually changes for defenders, based on the red team report, the community briefing, and the press coverage.

Cardinal, Russian Legion, and RuskiNet are flooding Telegram with fabricated breach claims. We analyzed every major claim. All fake.

On March 31, 2026, Claude Code's full source shipped to npm via a missing .npmignore file. What was exposed and how to check if your packages leak too.

Rapid-IR: Reforged is the IR platform built by an incident response team. Proprietary AI, continuous readiness, and a 20-minute guaranteed response.

How breach databases, stealer logs, and basic OSINT revealed the FBI Director's personal credentials, and what it means for executive security.

Profero IRT has uncovered a cryptocurrency wallet hijacking supply chain attack in the AppsFlyer Web SDK

OSINT validation of a Hebrew-language Telegram channel claiming doxxing data and breach material on Iranian judiciary, IRGC, and APT35 targets.

The complete analysis of Vietnamese Stealer - a Python-based info stealer using Telegram as a C2.

Profero uncovered an AtomicStealer campaign using a fake Apple Support site to trick macOS users into running a malicious bash command.

Executives are receiving physical letters that impersonate ransomware groups like BianLian and demand $5 million in Bitcoin. How Profero spotted the scam.

# From Friend to Foe: A New Era of Cybersecurity Incidents

How Profero helped recover ESXi data encrypted by DarkBit ransomware, a group suspected of nation-state ties, after the Isfahan drone attacks.

Since 2022, Profero's IRT has investigated Russian threat actors in Europe, where profit-driven ransomware groups now operate with state-endorsed hacking.

Live forensic collection from Ivanti EPMM appliances hit by zero-days CVE-2025-4427 and CVE-2025-4428, from Profero's May 2025 incident response work.

Profero IRT investigated a global phishing campaign on Microsoft 365 identities built on low-code platforms and phishing toolkits. Findings and defenses.

Quantum cryptography without the FUD: how quantum computers could break RSA and ECC, and what Quantum Key Distribution actually offers.

Security teams buy CTEM, CSPM, and IDM tools, yet breaches still happen. Why tools alone fail at detection, with ransomware and data breach case studies.

**Behind the Scenes: How Pager Apps** **Power 24/7 Incident Response Operations**

A guide to MITRE ATT&CK, the non-profit knowledge base of attack groups, tactics, and tools founded in 2013, and how to read the threat landscape with it.

In 2024 Profero tracked attacks built on misconfigurations and leaked secrets in production. Best practices for managing credentials, API keys, and tokens.

Every year, as we deck the halls and prepare to celebrate major holidays like July 4th,

Highlights from a Cloud Security Alliance Conference panel on cloud security from the attacker's perspective, featuring Profero CEO Omri Segev Moyal.

Built-in Windows settings that improve forensics readiness for IT and security teams, with no extra tools. A short cheat sheet of key artifacts and logs.

Profero is certified for SOC 2 Type 2 and ISO 27001 and launched a trust portal showing its security practices, controls, and certifications.

CVE-2024-3094, rated 10.0: a backdoor planted by a maintainer in xz-utils, a Linux component, putting SSH security at risk. What it is and why it matters.

SysAid disclosure of CVE-2023-47246, a zero-day in its on-premises software investigated with Profero. Customers should update to version 23.3.36.

## Focus Shift: Parallels between Europe and Israel's Cyber Incident Response Preparedness

What malicious browser extensions are and how to fight them, starting from the 1.7 billion Chrome users who had extensions installed in 2020.

see our previous [**blog post**](https://profero.io/posts/lastpass_breach/)

**disclaimer: this is based on our experience, expertise, and public sources**

Profero research on how attackers can hide their origin by launching cyberattacks from cloud IDEs on online programming learning sites.

How multi-factor authentication works, from SMS and authenticator apps to YubiKey, and the bypass methods attackers use against it in the wild.

Profero releases a static unpacker and decoder for the Go packer that decrypts Hello Kitty ransomware's C++ payload in memory before running it.

Why the OSS model is broken, why log4j maintainers should not take the blame, and the $5,000 donation Profero pledged to the project.

Profero built a scanner that finds log4j-vulnerable web servers on internal networks, so customers need not send server data to third parties.

On December 9th, 2021 news broke about a newly discovered vulnerability affecting the java logging library, Log4j.

Cloud breaches an IR team sees that could have been prevented, with case studies and advice on cloud provider APIs, training, and preparation.

Profero found a bug in RansomEXX Linux ransomware that corrupts files, and released a tool that extracts keys from the attacker's decryptor to rescue them.

Profero IR analysis of Ever101 ransomware: a new file extension, a Music folder of dropped tools, and the toolset used to build an attribution profile.

Profero and SecurityJoes investigated a Cuba ransomware attack that encrypted hundreds of machines using PowerShell, SystemBC, and Cobalt Strike.

How a Profero engagement during COVID-19 crossed the line between nation-state and cybercrime when APT27 turned to ransomware. Full report, no form.