Agents of chaos: the rise of the agentic swarm
Swarms of AI agents working together are now behind some of the year’s most serious security incidents.
8 minutes
Threat Intelligence
Fake court ADR phishing campaign distributes LodaRAT
A phishing campaign impersonating a U.S. federal court targets more than 100,000 companies and delivers LodaRAT, a commodity remote access…
14 minutes
CARBONATO: a botnet built around an AI agent
ThreatDown researchers uncovered CARBONATO, a Docker botnet built around an AI agent that compromises exposed Docker daemons, spreads across reachable…
11 minutes
This SonicWall bug is 2 years old. Akira ransomware is still exploiting it.
No zero-day required. Just a patch left unapplied.
4 minutes
AI threat so great that security “takes precedence over everything except critical business operations”
What OpenAI’s open letter means for teams running lean.
5 minutes
How Grok unknowingly powers cybercrime
Kriminal isn't a custom-built criminal AI model: it's Grok in a trench coat. The proof sits in its own code.
6 minutes
The AI era of cybercrime has arrived: The 2026 Cybercrime in the age of AI report
New research reveals how AI is rewiring cybercrime today, and how you can prepare for what's coming tomorrow.
1 minute
Prinz Eugen ransomware: a deep dive into a new Go-based encryptor
Prinz Eugen is a new Go-based ransomware family that encrypts files, prioritizes fresh data, and extorts victims out-of-band, leaving a…
12 minutes
CastleRAT attack first to abuse Deno JavaScript runtime to evade enterprise security
ThreatDown has discovered a sophisticated new infection chain that installs the CastleRAT malware without leaving a trace on disk.
4 minutes
Machine-scale cybercrime: The 2026 State of Malware report
The ThreatDown 2026 State of Malware report captures a unique moment of transition—when the established world of human-driven intrusion meets…
3 minutes
AI-orchestrated cyberattacks
Sophisticated attackers once struggled to scale. Now, experienced groups can scale by adding agents to their workforce, and inexperienced or…
4 minutes
Inside EDR-Freeze: How ThreatDown stops the attack before it spreads
EDR-Freeze exploits legitimate Windows functionality to suspend security software, and it works entirely in user-mode using native Windows components.
11 minutes
EDR vs MDR vs XDR – What’s the Difference?
Learn about the differences between EDR, MDR, and XDR solutions—and how they each alleviate the challenges of cybersecurity teams.
5 minutes
KMSpico explained: No, KMS is not “kill Microsoft”
KMSpico is one of the most popular hack tools for activating pirated copies of Microsoft products. Here’s why we don’t…
3 minutes
When you shouldn’t trust a trusted root certificate
A trusted root certificate is the cornerstone of authentication and security on the Internet. But even this can be abused.…
5 minutes
Ransomware in April 2025—RansomHub is gone
While DaVita and Marks & Spencer reel from devastating attacks, the most dominant ransomware group of the last year has…
1 minute
Ransomware in March 2025
March 2025 saw a huge number of ransomware attacks, and the Pennsylvania State Education Association quietly notify over 500,000 current…
1 minute
Has AI changed malicious script obfuscation techniques?
Obfuscation techniques have changing since generative AI became widely available.
3 minutes
Fake Booking.com emails target hotels
A new phishing campaign is using a famous brand to compromise hotels.
1 minute
Sign up to get the latest threat intelligence.
Subscribe to newsletterThreatDown is ranked as a leader in EDR + MDR by G2
