“post - compromise. concurrently, the warlock group, also known as water manaul, exploits unpatched microsoft sharepoint servers and uses a vulnerable " nseckrnl. sys " driver in byovd attacks to terminate security products at the kernel level, replacing previously used drivers, a…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1486Data Encrypted for Impact
98%
“/ 2026 / 04 / qilin - and - warlock - ransomware - use. html https : / / www. hendryadrian. com / ransom - agencavi - srl - mar - 2026 / https : / / www. hendryadrian. com / ransom - alarmco - mar - 2026 / https : / / www. hendryadrian. com / ransom - arca - service - mar - 2026 …”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
98%
“flaw ( cwe - 284 ) enables an unauthenticated attacker to execute unauthorized code or commands via crafted requests, thereby bypassing api authentication and authorization. active exploitation of this vulnerability has been confirmed in the wild, with initial exploitation attemp…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
97%
“/ forticlient - ems - zero - day - cve - 2026 - 35616 / https : / / www. hendryadrian. com / new - forticlient - ems - flaw - exploited - in - attacks - emergency - patch - released / https : / / www. securityweek. com / fortinet - rushes - emergency - fixes - for - exploited - z…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1486Data Encrypted for Impact
97%
“: / / www. hendryadrian. com / ransom - von - weise - associates - mar - 2026 / https : / / www. hendryadrian. com / ransom - wal - consultant - mar - 2026 / https : / / www. hipaajournal. com / data - breaches - corewell - health - rocky - mountain - care /”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1486Data Encrypted for Impact
96%
“https : / / www. hendryadrian. com / ransom - millerfoto - mar - 2026 / https : / / www. hendryadrian. com / ransom - muffett - mar - 2026 / https : / / www. hendryadrian. com / ransom - nanxun - enterprise - co - ltd - mar - 2026 / https : / / www. hendryadrian. com / ransom - n…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1486Data Encrypted for Impact
96%
“com / ransom - seeing - machines - jan - 2026 / https : / / www. hendryadrian. com / ransom - seram - spa - mar - 2026 / https : / / www. hendryadrian. com / ransom - service - star - freightways - mar - 2026 / https : / / www. hendryadrian. com / ransom - shwapno - mar - 2026 / …”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1068Exploitation for Privilege Escalation
93%
“- zones - controller - cve - 2026 - 2699 / https : / / www. thehackerwire. com / cve - 2026 - 2701 - authenticated - rce - via - malicious - file - upload / qilin and warlock ransomware use vulnerable drivers to disable 300 + edr tools qilin and warlock ransomware operations are …”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1486Data Encrypted for Impact
93%
“- 2026 / https : / / www. hendryadrian. com / ransom - chek - news - apr - 2026 / https : / / www. hendryadrian. com / ransom - chickasaw - holding - mar - 2026 / https : / / www. hendryadrian. com / ransom - dielco - mar - 2026 / https : / / www. hendryadrian. com / ransom - doc…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
88%
“##inet to all identified forticlient ems instances running versions 7. 4. 5 and 7. 4. 6. - if patching cannot be performed immediately, restrict network access to the forticlient ems management interface to only trusted ip addresses and administrative subnets using firewall rules…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
87%
“chain of vulnerabilities in progress sharefile storage zone controller branch 5. x, specifically version 5. 12. 3 and earlier, leading to pre - authenticated remote code execution ( rce ), resolved in version 5. 12. 4 on march 10, 2026. the first vulnerability, cve - 2026 - 2699,…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1525Implant Internal Image
78%
“##m roles and service account permissions in cloud and on - premise environments to enforce the principle of least privilege, ensuring applications only have the minimum access required. - integrate automated secret scanning tools into your ci / cd pipelines and source code repos…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1588.006Vulnerabilities
72%
“covers all critical infrastructure, including management servers, to proactively identify and prioritize patching before vulnerabilities are actively exploited. - deploy a web application firewall ( waf ) in front of critical web - based management interfaces to monitor, filter, …”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1068Exploitation for Privilege Escalation
72%
“the malicious file ' msimg32. dll ', particularly in relation to dll side - loading events. - use your edr or siem to hunt for the presence or loading of the driver file ' rwdrv. sys ' or ' throttlestop. sys ' on endpoints. - use your edr or siem to hunt for the presence or loadi…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1525Implant Internal Image
58%
“selling access. organizations are advised to audit environments for least privilege, enable secret scanning, avoid ssh key reuse, implement imdsv2 enforcement on aws ec2 instances, and rotate credentials if compromise is suspected. severity : critical threat details and iocs miti…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
51%
“can set the ` network share location ` to a webroot directory ( e. g., ` c : \ inetpub \ wwwroot \ sharefile \ storagecenter \ documentum ` ) and then upload a zip file containing an aspx webshell to ` / upload. aspx ` with the ` unzip = true ` parameter. this upload requires cal…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
48%
“covers all critical infrastructure, including management servers, to proactively identify and prioritize patching before vulnerabilities are actively exploited. - deploy a web application firewall ( waf ) in front of critical web - based management interfaces to monitor, filter, …”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1588.006Vulnerabilities
48%
“intelligence / darksword - ios - exploit - chain / https : / / cyberguy. com / security / darksword - leak - millions - iphone - users - risk / https : / / cyberinsider. com / apple - expands - darksword - protections - to - more - iphones - with - ios - 18 - 7 - 7 - update / htt…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1190Exploit Public-Facing Application
30%
“they are included in the scope of the vulnerability management program for frequent scanning and prioritized patching. https : / / buaq. net / go - 407240. html https : / / cyberveille. esante. gouv. fr / alertes / progress - sharefile - cve - 2026 - 2699 - 2026 - 04 - 03 https :…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
Summary
These are the top threats you should know about this week.