As cited
Copy frozen at (site build).
threat intel
What’s Trending: Top Cyber Attacker Techniques, June–August 2026
A ReliaQuest threat research report covering June through August 2026 documents a surge in identity-led intrusions where attackers use social engineering, device-code phishing, and external Teams impersonation to gain persistent cloud access and execute data theft or ransomware attacks. Extortion groups ShinyHunters and Helix demonstrated how compromised identities can be weaponized to enumerate and bulk-download SharePoint data within minutes, while attackers abuse legitimate remote-management tools, SMB protocols, and unmonitored virtual machines to move laterally and deploy encryption. The report emphasizes that password resets alone fail to remove attacker-controlled devices, authentication methods, and refresh tokens, requiring defenders to revoke sessions, remove unauthorized enrollment, and correlate identity changes with follow-on SaaS activity.
Why it matters: Enterprise security teams across PSTS, manufacturing, and other sectors face active campaigns using vishing and device-code phishing to establish persistent access; defenders must implement session revocation, device removal, and SaaS audit logging to detect and contain identity-led intrusions before data theft or encryption occurs. CVE-2026-12569 in PTC Windchill is actively exploited by extortion groups to access product lifecycle management systems storing intellectual property and credentials; patching internet-facing systems on emergency timelines is critical for manufacturing and PSTS organizations.
- Source published
- First seen by Cybersecurity Tracker