AI threat so great that security “takes precedence over everything except critical business operations”
What OpenAI’s open letter means for teams running lean.
5 minutes
Threat Intelligence
How Grok unknowingly powers cybercrime
Kriminal isn't a custom-built criminal AI model: it's Grok in a trench coat. The proof sits in its own code.
6 minutes
The AI era of cybercrime has arrived: The 2026 Cybercrime in the age of AI report
New research reveals how AI is rewiring cybercrime today, and how you can prepare for what's coming tomorrow.
1 minute
Prinz Eugen ransomware: a deep dive into a new Go-based encryptor
Prinz Eugen is a new Go-based ransomware family that encrypts files, prioritizes fresh data, and extorts victims out-of-band, leaving a…
12 minutes
CastleRAT attack first to abuse Deno JavaScript runtime to evade enterprise security
ThreatDown has discovered a sophisticated new infection chain that installs the CastleRAT malware without leaving a trace on disk.
4 minutes
Machine-scale cybercrime: The 2026 State of Malware report
The ThreatDown 2026 State of Malware report captures a unique moment of transition—when the established world of human-driven intrusion meets…
3 minutes
AI-orchestrated cyberattacks
Sophisticated attackers once struggled to scale. Now, experienced groups can scale by adding agents to their workforce, and inexperienced or…
4 minutes
Inside EDR-Freeze: How ThreatDown stops the attack before it spreads
EDR-Freeze exploits legitimate Windows functionality to suspend security software, and it works entirely in user-mode using native Windows components.
11 minutes
EDR vs MDR vs XDR – What’s the Difference?
Learn about the differences between EDR, MDR, and XDR solutions—and how they each alleviate the challenges of cybersecurity teams.
5 minutes
KMSpico explained: No, KMS is not “kill Microsoft”
KMSpico is one of the most popular hack tools for activating pirated copies of Microsoft products. Here’s why we don’t…
3 minutes
When you shouldn’t trust a trusted root certificate
A trusted root certificate is the cornerstone of authentication and security on the Internet. But even this can be abused.…
5 minutes
Ransomware in April 2025—RansomHub is gone
While DaVita and Marks & Spencer reel from devastating attacks, the most dominant ransomware group of the last year has…
1 minute
Ransomware in March 2025
March 2025 saw a huge number of ransomware attacks, and the Pennsylvania State Education Association quietly notify over 500,000 current…
1 minute
Has AI changed malicious script obfuscation techniques?
Obfuscation techniques have changing since generative AI became widely available.
3 minutes
Fake Booking.com emails target hotels
A new phishing campaign is using a famous brand to compromise hotels.
1 minute
Ransomware in February 2025—Cl0p and RansomHub run riot
The Cl0p ransomware group posted data on 335 victims in February 2025, by far the largest one month total any…
2 minutes
Phishers go “interplanetary” to get company login credentials
An ongoing campaign to harvest company login credentials is using IPFS to host its phishing pages.
1 minute
“Enhanced Bonus” QR code phish steals Microsoft credentials
A personalized phishing attack could lead to a catastrophic loss of credentials.
2 minutes
USB worms: Still wriggling on to under-protected computers after all these years
Malware doesn't care if it's being talked about or not.
2 minutes
20
26Cybercrime in the Age of AI
AI is rewiring the cybercrime ecosystem.
You have six months to prepare.