WIP26 Abuses Cloud Infrastructure In Targeted Telco Attacks
The WIP26 threat actor targeted telecommunication providers in the Middle East with custom backdoors to gain access and exfiltrate sensitive data.
Public Cloud infrastructure including Microsoft 365 Mail Microsoft Azure Google Firebase and Dropbox was used to evade detection and stay under the radar.
The malware used in the operation CMD365 and CMDEmber used invalid digital signatures for defense evasion and scheduled tasks for persistence.
Featured Resources
View More Resources
blog
Project Glasswing: What Anthropic's AI Cyber Evaluations Mean for Security Validation
Project Glasswing shows frontier AI can find and exploit software flaws at scale, making continuous validation vital.
blog
MITRE ATLAS AI Security Framework: Tactics and Techniques Explained
AI models, copilots and agents are now part of the enterprise attack surface. By connecting them to corporate data, repositories,
blog
Operationalizing Agentic Cyber Defense Engineering for SecOps
Security operations teams spend too much of each day gathering context, configuring assessments, correlating evidence and coordinating follow-up actions across