Threat Insights — ExtraHop

THREAT INSIGHTS

featured

2025 Global Threat Landscape Report

The threat landscape is evolving at an unprecedented pace. Timely intelligence regarding attack surfaces, threat actors, ransomware trends, and more empowers your enterprise to make faster, smarter security decisions.

Read the Report

EBOOK

The Agentic SOC Blueprint: A Data-First Revolution

RESOURCE

NDR Detections Catalog

How ExtraHop Modern NDR Detects Adversaries in Your Network

Anatomy of an Attack

VIPERTUNNEL

June 30, 2026

Examine how VIPERTUNNEL uses Python execution, file-type masquerading, and SOCKS5 tunneling to support ransomware-linked intrusions, and how ExtraHop RevealX helps detect the activity.

Inside Interlock Ransomware Operations

June 16, 2026

Examine how the Interlock ransomware group leverages living off the land techniques and cloud exfiltration, and how ExtraHop RevealX detects the intrusion.

The DINDOOR Backdoor

May 12, 2026

Iranian APT MuddyWater (Seedworm) is targeting organizations with a new, undocumented backdoor called DINDOOR. Discover how this campaign exploits the Deno runtime and Rclone for cloud exfiltration to bypass EDR, and learn how network detection and response (NDR) can help provide the visibility needed to stop these stealthy threats.

The Copy Fail: Linux Kernel Local Privilege Escalation

May 4, 2026

Uncover the "Copy Fail" logic flaw (CVE-2026-31431) that enables instant root access on nearly all major Linux distributions. Learn how this vulnerability bypasses file integrity monitoring and why network-based behavioral analysis is critical for securing containerized and cloud environments.

The MIMICRAT CLICKFIX Campaign

April 28, 2026

Expose how the MIMICRAT campaign weaponizes compromised financial sites and ClickFix lures to deploy fileless malware. See how ExtraHop RevealX provides the network-level ground truth to detect telemetry suppression and stealthy C2 patterns that bypass EDR.

The Chrysalis Backdoor and the Notepad++ Supply Chain Hijack

April 6, 2026

Unmask the Chrysalis backdoor and the sophisticated Notepad++ supply chain hijack orchestrated by Lotus Blossom. Learn how these state-sponsored attackers bypass traditional defenses and why network-level visibility is the ultimate key to stopping them.

CHAOS in a BLACKSUIT—Triple Extortion Ransomware

March 11, 2026

Discover how the Chaos threat group utilizes triple extortion to pressure victims. See how ExtraHop RevealX provides the decryption and network visibility required to expose these stealthy attackers before data is leaked.

From the Wire to the Data Center: Unmasking UNC5221 and the BRICKSTORM Backdoor

February 20, 2026

Discover how UNC5221 exploits vCenter and ADFS. See how ExtraHop RevealX decrypts authentication protocols to expose the threat actors.

DarkSpectre

February 4, 2026

Defend your supply chain against DarkSpectre’s evolving browser-based threats. This deep dive covers operational pillars like "The Zoom Stealer," MITRE ATT&CK TTPs, and actionable remediation strategies using allow-lists and network-centric security.

Anatomy of an Attack: European Cyber Threat Landscape: December 2025

January 14, 2026

Explore how specialized cyber operations in December 2025 weaponized BitLocker and used traffic mimicry to target critical infrastructure in Romania, France, and the UK. Learn how ExtraHop RevealX detects these "Living off the Land" tactics and supply chain breaches.