Threat Intelligence

What we're seeing in the wild.

Incident response is a goldmine for up-to-date threat actor tactics and techniques. Read about what we're seeing, and how businesses can protect themselves.

Latest research

Threat intelligence library

Flowchart showing mailbox compromise and ClickFix infostealer phishing attack paths.

Cyber threat intelligence

Protecting Against Modern Phishing

Modern phishing no longer always looks fake. This guide explains how mailbox-led attacks, SharePoint lures, device code phishing and ClickFix pages work, and what organisations should train, block and monitor.

Jun 1, 202611 min readRead

Threat Intelligence

PHPanic: Two Critical Flaws Put Web Servers at Risk of Remote Code Execution

Two critical PHP flaws expose web servers to remote code execution. Jordan Newman examines exploitation conditions, forensic limitations, and a Sigma detection rule.

Jordan Newman

Oct 21, 202619 min readRead

Threat Intelligence

Zammad 0-day chain and AI-assisted post-exploitation in the wild

We examine the Zammad exploit chain used against DIVD, reproduce initial access in our lab, and show how Strand reconstructs the attack from forensic evidence.

Jordan Newman

Oct 16, 202613 min readRead

Threat Intelligence

Threat Actor Tradecraft – The Residential Proxy Problem

Threat actors are moving from VPNs to residential proxies, routing attacks through ordinary home connections. How they work, and how Strand now detects them.

Will Poole and Jordan Newman

Oct 6, 20266 min readRead

See more threat intelligence

Loading threat intelligence articles…