Platform

< Platform

Partners

< Partners

Resources

< Resources

Company

< Company

Home > Blog

Threat Intelligence

CARBONATO: a botnet built around an AI agent

ThreatDown researchers uncovered CARBONATO, a Docker botnet built around an AI agent that compromises exposed Docker daemons, spreads across reachable…

11 minutes

This SonicWall bug is 2 years old. Akira ransomware is still exploiting it.

No zero-day required. Just a patch left unapplied.

4 minutes

AI threat so great that security “takes precedence over everything except critical business operations”

What OpenAI’s open letter means for teams running lean.

5 minutes

How Grok unknowingly powers cybercrime

Kriminal isn't a custom-built criminal AI model: it's Grok in a trench coat. The proof sits in its own code.

6 minutes

Abstract glowing neural network illustration representing cybercrime in the age of AI

The AI era of cybercrime has arrived: The 2026 Cybercrime in the age of AI report

New research reveals how AI is rewiring cybercrime today, and how you can prepare for what's coming tomorrow.

1 minute

Illustrated German heavy cruiser Prinz Eugen sailing the North Atlantic, 1941.

Prinz Eugen ransomware: a deep dive into a new Go-based encryptor

Prinz Eugen is a new Go-based ransomware family that encrypts files, prioritizes fresh data, and extorts victims out-of-band, leaving a…

12 minutes

CastleRAT

CastleRAT attack first to abuse Deno JavaScript runtime to evade enterprise security

ThreatDown has discovered a sophisticated new infection chain that installs the CastleRAT malware without leaving a trace on disk.

4 minutes

2026 State of Malware report

Machine-scale cybercrime: The 2026 State of Malware report

The ThreatDown 2026 State of Malware report captures a unique moment of transition—when the established world of human-driven intrusion meets…

3 minutes

How to prevent a rootkit attack

Gilad Maayan

7 minutes

Conductor

AI-orchestrated cyberattacks

Sophisticated attackers once struggled to scale. Now, experienced groups can scale by adding agents to their workforce, and inexperienced or…

4 minutes

EDR-Freeze

Inside EDR-Freeze: How ThreatDown stops the attack before it spreads

EDR-Freeze exploits legitimate Windows functionality to suspend security software, and it works entirely in user-mode using native Windows components.

11 minutes

Cybersecurity Team Working on Computers

EDR vs MDR vs XDR – What’s the Difference?

Learn about the differences between EDR, MDR, and XDR solutions—and how they each alleviate the challenges of cybersecurity teams.

5 minutes

Digital skull formed from glowing yellow pixels, representing malware risks of KMSPico software

KMSpico explained: No, KMS is not “kill Microsoft”

KMSpico is one of the most popular hack tools for activating pirated copies of Microsoft products. Here’s why we don’t…

3 minutes

When you shouldn’t trust a trusted root certificate

A trusted root certificate is the cornerstone of authentication and security on the Internet. But even this can be abused.…

5 minutes

Ransomware review

Ransomware in April 2025—RansomHub is gone

While DaVita and Marks & Spencer reel from devastating attacks, the most dominant ransomware group of the last year has…

1 minute

Ransomware review

Ransomware in March 2025

March 2025 saw a huge number of ransomware attacks, and the Pennsylvania State Education Association quietly notify over 500,000 current…

1 minute

JavaScript

Has AI changed malicious script obfuscation techniques?

Obfuscation techniques have changing since generative AI became widely available.

3 minutes

Booking.com

Fake Booking.com emails target hotels

A new phishing campaign is using a famous brand to compromise hotels.

1 minute

Ransomware review

Ransomware in February 2025—Cl0p and RansomHub run riot

The Cl0p ransomware group posted data on 335 victims in February 2025, by far the largest one month total any…

2 minutes

Planets

Phishers go “interplanetary” to get company login credentials

An ongoing campaign to harvest company login credentials is using IPFS to host its phishing pages.

1 minute

Sign up to get the latest threat intelligence.

Subscribe to newsletter