Insights

Kali365 Infrastructure: Abusing OAuth Device Code Phishing

Tue, 19 May 2026 00:00:00 GMT

Stay ahead of emerging identity-based phishing threats with Obrela’s latest Threat Advisory on the rapidly evolving Kali365 Phishing-as-a-Service (PhaaS) operation.

Emerging Cybersecurity Risks From High-Capability AI Models

The Obrela Threat Intelligence Team — Tue, 05 May 2026 00:00:00 GMT

As AI capabilities continue to evolve, so do the opportunities for cyber adversaries to operate faster and at greater scale.

Digital Universe Report 2025

The Obrela Threat Intelligence Team — Fri, 27 Mar 2026 00:00:00 GMT

Security Threat Landscape

The 2025 Digital Universe Report highlights a major shift in the cyber threat landscape. Attackers are moving away from high-volume attacks toward targeted, stealthy, and identity-driven operations, focusing on blending into environments rather than breaking into them.

Iran-Linked Threat Activity Escalates Amid Middle East Geopolitical Tensions

The Obrela Threat Intelligence Team — Mon, 02 Mar 2026 00:00:00 GMT

Description

Amid rapidly escalating geopolitical tensions in the Middle East, Obrela’s Threat Intelligence Team has identified increased cyber threat activity associated with Iranian state-sponsored and ideologically aligned actors.

Limited-Time DFIR Retainer Offer

No Author — Wed, 10 Dec 2025 00:00:00 GMT

As year-end approaches, organisations face a significant rise in cyberattacks—often when teams are least prepared and attackers are most active. To support our valued partners during this high-risk period, Obrela is offering a limited-time Pre-Paid Digital Forensics & Incident Response (DFIR) Retainer Bundle, available until 31 December.

Digital Universe Report H1 2025 Report

The Obrela Threat Intelligence Team — Wed, 03 Sep 2025 00:00:00 GMT

Obrela’s Digital Universe Report for H1 2025 provides a comprehensive analysis of the global cybersecurity threat landscape, highlighting important shifts in attacker behaviour, sector-specific vulnerabilities, and advanced adversarial techniques. In the first half of 2025, Brute Force attacks grew and dominated the alert landscape (27%), alongside sharp increases in vulnerability scanning (22%) and detections based on known malicious indicators (20%). This demonstrates that adversaries are focusing on scalable, stealthy entry methods.

ShinyHunters Threat Campaign and Activity Update

The Obrela Threat Intelligence Team — Thu, 21 Aug 2025 00:00:00 GMT

Prolific threat group ShinyHunters, previously reported on by Obrela, is in the middle of an ongoing threat campaign following a year of inactivity. Targeting Salesforce instances, the group has been exploiting a number of significant global organizations and extorting victims.

Surge in Maritime-Focused Phishing Campaigns Deploying Remcos RAT via Archive Files

The Obrela Threat Intelligence Team — Thu, 17 Jul 2025 00:00:00 GMT

Following our recent advisory on WinRAR-related threats, Obrela has identified a significant escalation in phishing campaigns targeting Greek maritime organizations, leveraging compressed archives to deliver the Remcos Remote Access Trojan (RAT).

WinRAR 0-Day Remote Code Execution (RCE) Exploit for Sale

The Obrela Threat Intelligence Team — Thu, 17 Jul 2025 00:00:00 GMT

A threat actor, "zeroplayer," has advertised an alleged zero-day Remote Code Execution (RCE) exploit for the WinRAR archiving software on a dark web forum. The asking price for the exploit is listed as $80,000.

Cisco ISE Cloud Static Credentials with CVE-2025-20286

The Obrela Threat Intelligence Team — Fri, 06 Jun 2025 00:00:00 GMT

A vulnerability has been identified in cloud deployments of Cisco Identity Services Engine (ISE). The vulnerability could allow unauthenticated attackers to access sensitive data, execute limited administrative operations, and more. The vulnerability (CVE-2025-20286) has a Critical CVSSv3.1 score of 9.9 out of 10.