TLP:CLEAR · OPEN PUBLICATION DESK · {{ today }} 47 ANALYSTS ON WATCH POSTURE · ELEVATED DOSSIER · TD-2026-0617
RESOURCES · INTELLIGENCE DESK

Intelligence from
the front line.

A desk staffed around the clock, publishing what our analysts are seeing the moment they see it. 18 PB of telemetry a day means we get a head start — and you get the call before the rest of the internet does.

18 PB
TELEMETRY / DAY
4.2 B
THREATS NEUTRALIZED
240
ADVERSARIES TRACKED
TODAY'S DOSSIER · {{ today }}
ALL DOSSIERS →
CLASSIFICATION · TLP:CLEAR DOSSIER · TD-2026-0617 PUBLISHED · {{ today }} · 06:00 UTC NEW
ADVISORY · JUN 2026

Identity-first intrusions are now the majority vector.

ABSTRACT

Across 4.2B blocked events this quarter, valid-credential abuse overtook every other entry point. We break down how attackers get in, where defenders are still looking the wrong way, and the three controls that move the needle most.

TV
T. Volkov
CHIEF THREAT INTELLIGENCE
FIGURE 1 · INITIAL ACCESS VECTOR · 2026
Identity & credentials 54% ↑ 18
Endpoint 21% ↓ 9
Cloud 16% ↑ 4
Network 9% ↓ 13
n = 4.2B blocked events · year-over-year delta shown · source: TD telemetry, 2025 Q2 → 2026 Q2
ADVERSARY WATCH · ACTIVE
Six dossiers we'd hand to your CISO this week.
ALL 240 TRACKED ADVERSARIES →
IRONVEIL CRIT
APT · STATE-NEXUS
ORIGIN PRC-N AKA Bronze Citadel · Eclipse Stoat · TaskRabbit-9 TARGETS Energy · Telco · Defense TOP TTPs T1059 · T1078 · T1014
CONF
LAST SEEN · 14 m
CINNABAR-49 HIGH
ECRIME · RAAS
ORIGIN RU-S AKA ScarVault · MetalChain · RAGE-49 TARGETS Finance · Healthcare · Retail TOP TTPs T1566 · T1621 · T1486
CONF
LAST SEEN · 6 h
BLUEHEM MOD
HACKTIVIST · STATE-ALIGNED
ORIGIN KP-A AKA Patriot-8 · AzureMagpie · OffshoreCondor TARGETS Government · Media · Critical infra TOP TTPs T1491 · T1052 · T1485
CONF
LAST SEEN · 14 d
AMBER-COBRA HIGH
APT · STATE-NEXUS
ORIGIN IR-W AKA Wisteria Snake · Saffron Sting TARGETS Diplomacy · NGOs · Universities TOP TTPs T1566.001 · T1528 · T1098
CONF
LAST SEEN · 3 d
SILT-PARLIAMENT MOD
ECRIME · ACCESS BROKER
ORIGIN BR-E AKA ParlayBroker · RustySills TARGETS Healthcare · SaaS · Manufacturing TOP TTPs T1539 · T1078.004 · T1133
CONF
LAST SEEN · 1 d
HOLLOWPINE HIGH
INSIDER · UNATTRIBUTED
ORIGIN UNATTRIBUTED AKA PineMarten · HollowOwl TARGETS Telco · Cloud SPs · MSPs TOP TTPs T1052.001 · T1555 · T1556
CONF
LAST SEEN · 9 h
OPEN FILES
The rest of the desk, organized.
SEARCH THE ARCHIVE →
THE DESK · LIVE BRIEFINGS

Get in the room with the analysts.

Weekly threat syncs, monthly deep dives, quarterly intelligence reviews. Open seats unless marked customer-only.

SUBSCRIBE TO THE DESK
The wire, in your inbox.

Daily wire summary, weekly synthesis, and adversary watch alerts. 12,400 defenders subscribed. Unsubscribe in one click.
You're on the list. A confirmation is on its way to {{ subEmail }}.
END OF PUBLIC RELEASE NEXT DROP · {{ nextDrop }} DESK · TD-RESOURCES · v2026.06 ARCHIVE →
// TLP:CLEAR · OPEN PUBLICATION DESK · {{ today }} 47 ANALYSTS ON WATCH POSTURE · ELEVATED DOSSIER · TD-2026-0617
// RESOURCES · INTELLIGENCE DESK

Intelligence from
the front line.

A desk staffed around the clock, publishing what our analysts are seeing the moment they see it. 18 PB of telemetry a day means we get a head start — and you get the call before the rest of the internet does.

18 PB
TELEMETRY / DAY
4.2 B
THREATS NEUTRALIZED
240
ADVERSARIES TRACKED
// TODAY'S DOSSIER · {{ today }}
ALL DOSSIERS →
CLASSIFICATION · TLP:CLEAR DOSSIER · TD-2026-0617 PUBLISHED · {{ today }} · 06:00 UTC NEW
ADVISORY · JUN 2026

Identity-first intrusions are now the majority vector.

ABSTRACT

Across 4.2B blocked events this quarter, valid-credential abuse overtook every other entry point. We break down how attackers get in, where defenders are still looking the wrong way, and the three controls that move the needle most.

TV
T. Volkov
CHIEF THREAT INTELLIGENCE
FIGURE 1 · INITIAL ACCESS VECTOR · 2026
Identity & credentials 54% ↑ 18
Endpoint 21% ↓ 9
Cloud 16% ↑ 4
Network 9% ↓ 13
n = 4.2B blocked events · year-over-year delta shown · source: TD telemetry, 2025 Q2 → 2026 Q2
// ADVERSARY WATCH · ACTIVE
Six dossiers we'd hand to your CISO this week.
ALL 240 TRACKED ADVERSARIES →
IRONVEIL CRIT
APT · STATE-NEXUS
ORIGIN PRC-N AKA Bronze Citadel · Eclipse Stoat · TaskRabbit-9 TARGETS Energy · Telco · Defense TOP TTPs T1059 · T1078 · T1014
CONF
LAST SEEN · 14 m
CINNABAR-49 HIGH
ECRIME · RAAS
ORIGIN RU-S AKA ScarVault · MetalChain · RAGE-49 TARGETS Finance · Healthcare · Retail TOP TTPs T1566 · T1621 · T1486
CONF
LAST SEEN · 6 h
BLUEHEM MOD
HACKTIVIST · STATE-ALIGNED
ORIGIN KP-A AKA Patriot-8 · AzureMagpie · OffshoreCondor TARGETS Government · Media · Critical infra TOP TTPs T1491 · T1052 · T1485
CONF
LAST SEEN · 14 d
AMBER-COBRA HIGH
APT · STATE-NEXUS
ORIGIN IR-W AKA Wisteria Snake · Saffron Sting TARGETS Diplomacy · NGOs · Universities TOP TTPs T1566.001 · T1528 · T1098
CONF
LAST SEEN · 3 d
SILT-PARLIAMENT MOD
ECRIME · ACCESS BROKER
ORIGIN BR-E AKA ParlayBroker · RustySills TARGETS Healthcare · SaaS · Manufacturing TOP TTPs T1539 · T1078.004 · T1133
CONF
LAST SEEN · 1 d
HOLLOWPINE HIGH
INSIDER · UNATTRIBUTED
ORIGIN UNATTRIBUTED AKA PineMarten · HollowOwl TARGETS Telco · Cloud SPs · MSPs TOP TTPs T1052.001 · T1555 · T1556
CONF
LAST SEEN · 9 h
// OPEN FILES
The rest of the desk, organized.
SEARCH THE ARCHIVE →
// THE DESK · LIVE BRIEFINGS

Get in the room with the analysts.

Weekly threat syncs, monthly deep dives, quarterly intelligence reviews. Open seats unless marked customer-only.

// SUBSCRIBE TO THE DESK
The wire, in your inbox.

Daily wire summary, weekly synthesis, and adversary watch alerts. 12,400 defenders subscribed. Unsubscribe in one click.
You're on the list. A confirmation is on its way to {{ subEmail }}.
// END OF PUBLIC RELEASE NEXT DROP · {{ nextDrop }} DESK · TD-RESOURCES · v2026.06 ARCHIVE →