Unnamed threat actors
Named by 3 kept items in this workspace.
Search every workspace for Unnamed threat actors. It matches the name as written, so it can find other things that share it.
The items that name it 3
Threat actors who sent phishing emails abusing a legitimate Microsoft Power BI domain to deploy rogue ScreenConnect RMM instances; observed starting September 10 across multiple endpoints, with a related ScreenConnect client/configuration tied to 22 other endpoints in separate incidents.
Per Anthropic's 'Detecting and countering misuse of AI: September 2026' report, drove Claude and Claude Code as autonomous orchestrators across espionage, fraud and influence operations; rebuilt malware to evade detection, ran agent swarms, stole AI API keys from vendor evaluation sandboxes
Threat actors observed by Huntress SOC using defense evasion techniques to disable AV/EDR, including via compromised SonicWall VPN credentials, deploying an 'EDR Killer' binary in early February 2026
All threat actors in this workspace.