[FORECASTS] From Password Sprays to Tenant Sabotage: The 8-Week Iran Cyber Risk for U.S. and Israeli Orgs - UPDATED: 2026-03-26 Iran cyber risk is not about whether they’ll be active. They will. The real question is whether the next 8 weeks produce a publicly attributed, materially disruptive hit with a new twist beyond the…

Everyone’s gaming out “the big Iran cyber event.”
The smarter question: what if the real move is a quiet tenant or IdP sabotage that never looks big enough to brief… until you’re already negotiating blast radius?

Full piece here: blog.alphahunt.io/forecasts-fr...

#AlphaHunt #ThreatIntel

“Blockchain C2” sounds exotic until you realize it’s just a rotating pointer. Solana/EVM hold the URL, your malware still beelines to HTTPS/WebSocket.
If your logs don’t flag: RPC read → decode → first-seen domain, you’re missing the whole GlassWorm class of problems.

#AlphaHunt #ThreatIntel

[FORECASTS] From Password Sprays to Tenant Sabotage: The 8-Week Iran Cyber Risk for U.S. and Israeli Orgs Iran cyber risk isn’t just “watch for wipers.” It’s the same ugly identity-first playbook: password sprays, MFA abuse, cloud access… then maybe admin-plane sabotage. Recent reporting says activity is…

Everyone’s staring at OT and web shells for the next Iran-linked move.
Meanwhile the boring path is: password spray → M365/Okta foothold → “legit” admin changes that quietly rewire your tenant.

Full breakdown here:
blog.alphahunt.io/forecasts-fr...

#AlphaHunt #ThreatIntel

Every time LE slaps a seizure banner on a leak site, half the industry acts like the campaign is over. Meanwhile Cl0p is quietly testing how much “disruption” they can route around. Your risk model still assumes takedowns are real stops?

#AlphaHunt #ThreatIntel #Ransomware

Fraud teams keep looking for dodgy bettors. The real action is proxy networks using casinos and apps as money-transfer rails for scam centres and trafficking crews. If you’re not fusing cage + device + payment telemetry, you’re blind on purpose.

#AlphaHunt #ThreatIntel

[DEEP RESEARCH] Who’s Most Likely to Abuse MCP Integrations? UNC3944, TraderTraitor, UNC6293 Three intrusion sets already excel at getting users to approve tools and auth flows. This assessment is probabilistic: it highlights who is best positioned to adapt that tradecraft to MCP-style…

Most teams threat-model MCP like it’s another API surface. The crews lining up for it treat it like a social-engineering buffet: “install this tool, approve this repo, authorize this device.” No exploit required.

Full piece here: blog.alphahunt.io/deep-researc...

#AlphaHunt #ThreatIntel

The industry loves preparing for the last Iran headline. PLCs are real. That does not make them the only lane that matters. The interesting question is which “not supposed to be the main thing” path becomes the main thing anyway.

#AlphaHunt #ThreatIntel

Your “AI copilot” is basically a privileged integration you can’t see, can’t prove, and can’t audit.

If hyperscalers flip to signed-only connectors + real agent logs, a lot of current AI stack diagrams turn into evidence exhibits.

#AlphaHunt #ThreatIntel #AIsecurity

Teams keep treating IDE agents like fancy autocomplete when they’re really “remote code execution with better vibes.” Now add prompt injection from issues/docs/PRs and ask yourself how often anyone audits what the agent actually ran.

#AlphaHunt #ThreatIntel #AIDevSec

SIGNALS WEEKLY:

We keep treating control planes like background IT plumbing. Adversaries keep treating them like express lanes to the whole environment. Routers, CI/CD, identity flows, web-facing admin junk — same movie, worse blast radius.

#AlphaHunt #ThreatIntel

Most orgs threat model backups like a fire extinguisher, not a beachhead.

Meanwhile, PRC-linked crews are camping in Dell RecoverPoint, staring at your restore paths and VMware plane.

#AlphaHunt #ThreatIntel

A lot of orgs “secured” GitHub Actions by pinning to tags, which is a fun strategy if you enjoy finding out your trusted scanner now has initial access. CI trust is getting weird in ways most runbooks still don’t cover.

#AlphaHunt #ThreatIntel #SupplyChainSecurity

[FORECASTS] From Password Sprays to Tenant Sabotage: The 8-Week Iran Cyber Risk for U.S. and Israeli Orgs - UPDATED: 2026-03-26 Iran cyber risk is not about whether they’ll be active. They will. The real question is whether the next 8 weeks produce a publicly attributed, materially disruptive hit with a new twist beyond the…

Stryker wasn’t the “big Iran cyber moment.” That was just proof the ecosystem’s warmed up. The real coin flip is a boring tenant/UEM/IdP hit that’s disruptive, novel, and confidently pinned on Tehran.

Full forecast + failure modes: blog.alphahunt.io/forecasts-fr...

#infosec #AlphaHunt

People talk about “Will RedNovember use a zero‑day?” like the danger starts when the report drops. Interlock quietly worked a Cisco firewall 0‑day before anyone had a CVE to point at. Your problem is the lead time, not the logo.

#infosec #AlphaHunt

[DEEP RESEARCH] How Malware Uses Solana and EVM Chains to Rotate C2 Without Burning Infrastructure Malware is using blockchains as durable configuration mailboxes, not full C2. If you can spot the read→decode→connect sequence, you can preempt and burn the real infrastructure before it’s useful.

If your build agents are chatting with Solana/EVM RPC like day traders and then immediately reaching out to brand-new WebSocket endpoints, you don’t have “Web3 experimentation.” You have a rendezvous problem.

Full research here: blog.alphahunt.io/deep-researc...

#infosec #AlphaHunt

[FORECASTS] From Password Sprays to Tenant Sabotage: The 8-Week Iran Cyber Risk for U.S. and Israeli Orgs Iran cyber risk isn’t just “watch for wipers.” It’s the same ugly identity-first playbook: password sprays, MFA abuse, cloud access… then maybe admin-plane sabotage. Recent reporting says activity is…

Everyone’s staring at Iran for the big cinematic cyber moment. The smarter bet? A dull-looking password spray that turns into weeks of silent tenant sabotage in M365/Azure/Okta.

Full forecast and signals here: blog.alphahunt.io/forecasts-fr...

#AlphaHunt

[FORECAST UPDATED] After LockBit and BlackCat, Is Cl0p Really Next in Line? LockBit got Cronos’d. BlackCat caught a DOJ wrench to the teeth. Cl0p is still hanging around the enterprise software aisle like it owns the place. So… is it really next, or are we just recycling…

People keep talking like there’s a queue for takedowns: LockBit, BlackCat, now “Cl0p’s turn.” Sure. The press conference is easy. Sustained impact past 90 days is where most “disruptions” quietly fail.

Read the forecast: blog.alphahunt.io/forecast-upd...

#ransomware #AlphaHunt

[DEEP RESEARCH] Who’s Most Likely to Abuse MCP Integrations? UNC3944, TraderTraitor, UNC6293 Three intrusion sets already excel at getting users to approve tools and auth flows. This assessment is probabilistic: it highlights who is best positioned to adapt that tradecraft to MCP-style…

Everyone’s asking “what if MCP gets popped with a 0‑day” and almost nobody’s asking “who’s already trained users to rubber‑stamp shady tools and auth flows.”
Three intrusion sets are basically built for MCP-style abuse.

Full writeup here: blog.alphahunt.io/deep-researc...

#infosec #AlphaHunt

[FORECAST UPDATED] AI Agents as Regulated C2: Will Anyone Be Forced to Act? 🤖🔒 AI agents = privileged integrations you can’t see. After GTG-1002 + vendors pushing agent access standards, the next shoe drops: do regulators/hyperscalers force default-on signed connectors +…

Everyone’s debating “AI safety” at the model layer while AI agents quietly get domain creds, API keys, and prod access with less scrutiny than a new VPN user. That’s not assistance, that’s managed C2.

Full breakdown here: blog.alphahunt.io/forecast-upd...

#infosec #AlphaHunt

We threat model LLMs like glorified chatbots while shipping IDE agents that can touch prod-adjacent code, secrets, and shells. Prompt injection isn’t “theoretical” when a TODO comment can steer the thing with root on your repo.

#AIsecurity #AlphaHunt

Government fraud gets framed like a stack of scams. Cleaner lie. The real problem looks more like identity infrastructure with a payout engine attached. Same weak proofing, same rails, same movie, different claim form.

Read it here: blog.alphahunt.io/the-real-gov...

#AlphaHunt #ThreatIntel

CISA Flags Dell RecoverPoint Zero-Day: Backup Systems as the New Beachhead Your backup system isn’t your parachute. It’s a beachhead. 🏖️ Mandiant/GTIG report UNC6201 exploiting Dell RP4VM (CVE-2026-22769, CVSS 10.0). Hardcoded credential → OS-level control + root…

We keep treating backup gear like a safety net, not a primary attack surface. Hardcoded creds on a recovery box isn’t just “another CVE” — it’s how you lose trust in every restore.

Thread here on the Dell RecoverPoint zero-day: blog.alphahunt.io/cisa-flags-d...

#infosec #AlphaHunt

[FORECAST] Dismantled or Displaced? Cambodia’s Scam-Compound Crackdown by 2030? Cambodia says it sealed off ~190 scam sites. 🧨 Now the real question: dismantled or displaced? 🧱🚚 Our forecast uses grown-up metrics (convictions + asset denial + independent compound counts).

We keep treating crackdowns on Cambodia’s scam compounds as an endpoint instead of a routing change. Raids make headlines; organizer convictions, asset denial and dead hotspots change risk. Guess which one is rarer.

More here: blog.alphahunt.io/dismantled-o...

#infosec #AlphaHunt

SIGNALS WEEKLY:

Everyone loves “shift left” until the thing in the pipeline shifts your secrets somewhere else. Security tooling has officially joined the attack surface like it was invited.

Read: blog.alphahunt.io/signals-week...

#AlphaHunt #ThreatIntel

Everyone’s bragging about faster MTTR while attackers sit in SaaS via tokens and “trusted” OAuth apps. You don’t fix that with more alerts; you fix it with a small set of hunts you actually run.

#ThreatHunting #AlphaHunt

The next few months probably won’t belong to some magical new attack chain. More likely: the same old intrusion paths, just run faster, cleaner, and with less obvious malware for everyone to feel good about blocking.

Read: blog.alphahunt.io/the-next-3-6...

#AlphaHunt #ThreatIntel

Malware put C2 on-chain because apparently even botnets want “decentralization.” 🙃 Spot Solana/EVM read→decode→connect, burn the real infra first. Handy if your CI box suddenly thinks it’s a crypto bro. 🔥

#AlphaHunt #CyberSecurity #Solana #ThreatIntel

April Fools’ is Wednesday. Iran’s “joke” is password sprays + tenant sabotage aimed at U.S./Israeli orgs. If your cloud trust model is vibes-based, congrats on your future incident report 🤡⚠️

#AlphaHunt #CyberSecurity #Iran #Israel