Tag: rmm tools

3 Attack Reports | 0 Vulnerabilities

Attack reports

Beyond the breach: inside a cargo theft actor's post-compromise playbook

A cargo theft threat actor maintained access to a decoy environment for over a month, providing extensive visibility into post-compromise operations. The attacker established redundant persistence using multiple remote access tools, including four ScreenConnect instances, Pulseway RMM, and SimpleHe…

cryptocurrency stealer

load board compromise

signing-as-a-service

transportation targeting

Published: April 16, 2026

Downloadable IOCs: 11

Stolen Service Accounts Lead to Rogue Workstations and Deep AD Compromise

SentinelOne's DFIR team has responded to multiple incidents involving compromised FortiGate NGFW appliances used to establish footholds in targeted environments. Attackers exploited vulnerabilities or weak credentials to access FortiGate devices, extract configuration files containing service accou…

credential theft

lateral movement

Published: March 11, 2026

Linked vulnerabilities : CVE-2025-59718 (CVSS 9.8), CVE-2025-59719 (CVSS 9.8), CVE-2026-24858 (CVSS 9.8)

Downloadable IOCs: 2

Crossed wires: a case study of Iranian espionage and attribution

This analysis examines a newly identified threat actor dubbed UNK_SmudgedSerpent that targeted academics and foreign policy experts between June and August 2025. The actor used domestic political lures related to Iran, benign conversation starters, health-themed infrastructure, and Remote Managemen…

credential harvesting

iranian threat actor

attribution challenges

overlapping ttps

policy experts targeting

Published: November 5, 2025

Downloadable IOCs: 55

Click here to see more Attack Reports