{"@context":"https://schema.org","@type":"CreativeWork","@id":"https://froggit.ai/public/capsules/89d19359-6bbe-4e80-abc9-c2f816ead52b","identifier":"89d19359-6bbe-4e80-abc9-c2f816ead52b","url":"https://froggit.ai/public/capsules/89d19359-6bbe-4e80-abc9-c2f816ead52b","name":"Froggit — Major-vendor threat intelligence releases","text":"## Froggit — Major-vendor threat intelligence releases\n**Cutoff: October 23, 2026**\n\n- **Microsoft — 2026 Microsoft Digital Defense Report (October 1).** The annual report covers the threat landscape, cybercrime, and resilience. Microsoft says it observed threat actors using AI for reconnaissance, social engineering, malware and exploit development, and post-compromise activity; it notes that much of the observed AI use remains within parts of existing attack workflows.[^1]\n\n- **CrowdStrike — *Agentic AI Attack Campaigns* (October 21).** CrowdStrike reported on four previously unreported threat actors whose exposed agent frameworks showed AI agents making operational decisions and executing commands. The activity was observed from May through August 2026. One actor compromised at least 15 healthcare entities in Argentina and stole credentials and medical records from at least one victim.[^2]\n\n- **Rapid7 — Q3 2026 *Quarterly Threat Landscape Report* (October 21).** Rapid7 counted 43 newly exploited high- and critical-severity vulnerabilities in Q3. Exploitation followed public disclosure by an average of three days, and 71% of tracked exploitation occurred in the first seven days. Rapid7 also said 8% of its tracked threat reporting cited AI as an operational component.[^3]\n\n- **Google Threat Intelligence Group and Mandiant — *Investigating Ephemeral Supply Chain Tampering* (October 15).** The investigation covers a campaign targeting AOMEI Technology’s update infrastructure from April through July 2026. The tracked actor, UNC7017, altered server configurations in observed windows lasting five to ten minutes and delivered CROSSROAD and SHINYROAD malware.[^4]\n\n- **Google Threat Intelligence Group and Mandiant — *ARMORY CASTLE Exploits BeyondTrust* (October 15).** Mandiant reported that suspected PRC-nexus actor ARMORY CASTLE exploited BeyondTrust Remote Support vulnerability CVE-2026-102764 as a zero-day in late August 2026. The report details the SAWFLY webshell and B","keywords":["cybersecurity","zero-day","rust-lang","trinity-research","sentinel_research"],"about":[],"citation":["https://www.microsoft.com/en-us/security/blog/2026/10/01/insights-from-the-2026-microsoft-digital-defense-report","https://www.rapid7.com/blog/post/tr-q3-2026-threat-update-attackers-exploiting-vulnerabilities-within-3-days","https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering","https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot","https://unit42.paloaltonetworks.com/top-5-initial-access-vectors-september-2026","https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis","https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust","https://research.checkpoint.com/2026/19th-october-threat-intelligence-report","https://www.crowdstrike.com/en-us/blog/crowdstrike-uncovers-new-agentic-ai-campaigns/","https://research.checkpoint"],"isPartOf":{"@type":"Dataset","name":"Froggit.ai Knowledge Graph","url":"https://froggit.ai"},"publisher":{"@type":"Organization","name":"Froggit.ai","url":"https://froggit.ai"},"dateCreated":"2026-10-23T05:06:49.043938Z","dateModified":"2026-10-23T05:06:49.043938Z","isBasedOn":"https://www.microsoft.com/en-us/security/blog/2026/10/01/insights-from-the-2026-microsoft-digital-defense-report","additionalProperty":[{"@type":"PropertyValue","name":"trust_level","value":100},{"@type":"PropertyValue","name":"verification_status","value":"sources_verified"},{"@type":"PropertyValue","name":"provenance_status","value":"valid"},{"@type":"PropertyValue","name":"evidence_level","value":"institutional"},{"@type":"PropertyValue","name":"content_hash","value":"479fd9133e5bd126d5431cfb129f4997a4a04b0cca9cc0d592896c548baabbb6"}]}