# Initial Access Published articles for Initial Access. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Phishing Abuses RMM Tools for Persistent Access DevFeed: [Phishing Abuses RMM Tools for Persistent Access]() Original publisher: [Read original article]() Author: Microsoft Security Research, Parasharan Raghavan, Deva Kanna Kannan, Sai Chakri and Microsoft Defender Experts Published: 2026-09-29T21:39:27Z Content type: news Language: en Sources: [Microsoft Security]() Topics: [Security](), [Credential theft](), [Remote Access Trojan]() Tags: [follow](), [initial-access](), [microsoft-defender](), [phishing](), [powershell](), [remote-access](), [security](), [security-blog](), [social-engineering](), [tools]() ### AI overview Microsoft reports phishing campaigns that delivered a disguised MSP360 remote-management installer and used it to install ConnectWise ScreenConnect. The two tools created redundant remote-access channels for persistent access and follow-on activity, including information collection and credential-access operations. ### Source excerpt Microsoft observed phishing campaigns that abused MSP360 RMM to deploy ScreenConnect, creating redundant remote-access channels for follow-on activity The post Phishing Abuses RMM Tools for Persistent Access appeared first on Microsoft Security Blog. ## RemoteThreat Launches With $7 Million for Offensive Operations Platform DevFeed: [RemoteThreat Launches With $7 Million for Offensive Operations Platform]() Original publisher: [Read original article]() Author: SecurityWeek News Published: 2026-09-29T14:38:07Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [Agentic SOC](), [anthropic]() Tags: [agentic-ai](), [ai-assistants](), [c2](), [command](), [critical-infrastructure](), [cyber](), [cybersecurity-funding](), [datatribe](), [exploitation](), [funding](), [general](), [hacker](), [initial-access](), [o-c-o-platform](), [obfuscation](), [offensive-cyber-operations](), [offensive-security](), [operator](), [osage-university-partners](), [pre-seed](), [pre-seed-funding](), [remotethreat]() ### AI overview RemoteThreat launched from stealth with $7 million in pre-seed funding to develop an offensive cyber operations platform. Its O/C/O Platform combines mission planning, command and control, implants, access and obfuscation tools, targeting and analysis systems, and AI assistants for enterprise and critical infrastructure red teams, government mission teams, and vetted defense partners. Operations can be manual, AI-assisted, or delegated to autonomous workflows, with policies, approvals, and traceable decisions governing consequential actions. ### Source excerpt The company emerged from stealth mode with pre-seed funding from Osage University Partners and DataTribe. The post RemoteThreat Launches With $7 Million for Offensive Operations Platform appeared first on SecurityWeek. ## The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments DevFeed: [The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments]() Original publisher: [Read original article]() Author: Shahar Dorfman Published: 2026-09-25T14:51:15Z Content type: article Language: en Sources: [Wiz]() Topics: [credential-based attacks](), [Secrets Management](), [snyk]() Tags: [ai](), [api-keys](), [aws](), [azure](), [credentials](), [gcp](), [github](), [gitlab](), [identity](), [infostealer](), [initial-access](), [phishing](), [research](), [software](), [supply-chain]() ### AI overview Wiz Research analyzes NordStellar data to map credentials targeted by infostealer malware and assess their potential impact on cloud, code, and AI environments. The article describes how social engineering and supply chain attacks can steal developers' credentials, API keys, and session tokens, enabling access to cloud estates and code platforms. It also outlines the infostealer ecosystem, from malware services to underground marketplaces and initial access brokers. ### Source excerpt Wiz Research analyzes NordStellar data to map the credentials targeted by infostealer families and assess their potential impact across cloud, code, and AI environments. ## The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint DevFeed: [The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint]() Original publisher: [Read original article]() Author: Harlan Carvey; Lindsey O'Donnell-Welch Published: 2026-09-24T13:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [Vulnerabilities](), [Exploit](), [incident](), [Endpoint Security & XDR](), [.NET Framework](), [Windows](), [Monero](), [Microsoft]() Tags: [2025](), [actor](), [anydesk](), [architecture](), [cpu](), [cve](), [deploy](), [edr](), [exploited](), [incident](), [incident-report](), [initial-access](), [installation](), [it](), [microsoft](), [microsoft-defender](), [miner](), [net-framework](), [powershell](), [processes]() ### AI overview Huntress reports an incident in which attackers exploited a Samsung MagicINFO vulnerability, installed AnyDesk, and compiled a Monero cryptominer directly on a victim endpoint. The compilation activity produced a noticeable spike in EDR telemetry. ### Source excerpt Threat actors exploited Samsung MagicINFO to install AnyDesk, disable Defender, and compile a Monero miner directly on a victim endpoint. Learn the detection signals. ## US Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks DevFeed: [US Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks]() Original publisher: [Read original article]() Author: Eduard Kovacs Published: 2026-09-24T08:38:29Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [ransomware](), [Cybercrime](), [Malware]() Tags: [2019](), [2020](), [2026](), [attacks](), [cybercrime](), [doj](), [extortion](), [fraud](), [initial-access](), [ransomware](), [ransomware-attacks](), [ryuk](), [sentenced](), [uk](), [ukraine](), [us]() ### AI overview A US court sentenced Karen Vardanyan to 24 months in federal prison for his role in Ryuk ransomware attacks between 2019 and 2020. He was also ordered to pay more than $1.2 million in restitution after extorting over $1 million from victims. ### Source excerpt Karen Vardanyan has also been ordered to pay over $1.2 million in restitution to victims. The post US Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks appeared first on SecurityWeek. ## Rogue RMM Abuse: How Attackers Exploit Remote Access Tools DevFeed: [Rogue RMM Abuse: How Attackers Exploit Remote Access Tools]() Original publisher: [Read original article]() Author: Sarah Reddish; Beth Robinson Published: 2026-09-23T12:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [remote access](), [Security](), [Exploit](), [incident](), [Security Operations Center](), [Software]() Tags: [attacks](), [defensive](), [detection](), [exploit](), [exploits](), [huntress](), [initial-access](), [it](), [persistence](), [phishing](), [remote-access](), [security](), [soc](), [software]() ### AI overview A Huntress SOC investigation describes phishing attacks that tricked employees into installing rogue remote monitoring and management tools, including ITarian and ScreenConnect. Attackers used the tools to gain persistent remote access, add redundant access paths, evade detection, and expand their control within affected environments. ### Source excerpt The Huntress SOC uncovered phishing attacks that trick employees into installing rogue RMM tools like ScreenConnect for persistent access. Learn how to spot it. ## Ryuk ransomware member sentenced to 24 months in prison DevFeed: [Ryuk ransomware member sentenced to 24 months in prison]() Original publisher: [Read original article]() Author: Sergiu Gatlan Published: 2026-09-23T08:20:05Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [ransomware](), [Cybercrime](), [Hacking](), [Security]() Tags: [armenia](), [computer-help](), [computer-security](), [computers](), [cybercrime](), [cybercriminals](), [hacking](), [infosec](), [infosec-computer-security](), [initial-access](), [initial-access-broker](), [linux](), [mac](), [malware](), [malware-removal](), [prison](), [raas](), [ransomware](), [ransomware-attacks](), [ryuk](), [security](), [servers](), [spyware](), [support](), [tech-support](), [technical-support](), [usa](), [virus](), [virus-removal](), [windows]() ### AI overview A Ryuk ransomware participant was sentenced to 24 months in prison and three years of supervised release after pleading guilty to hacking U.S. companies and deploying ransomware. The attacks compromised organizations in multiple states and generated substantial ransom payments. Ryuk operated as a ransomware-as-a-service group from 2018 to 2020 before its successors continued operating under other ransomware brands. ### Source excerpt An Armenian man was sentenced to 24 months in prison and 3 years of supervised release for hacking U.S. companies and encrypting their systems in Ryuk ransomware attacks. [...] ## DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer DevFeed: [DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer]() Original publisher: [Read original article]() Author: James Northey; Andrew Brandt Published: 2026-09-22T21:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [Malware](), [Threat Hunting & Intel](), [Social engineering](), [Visual Basic](), [remote access](), [Windows](), [spoofing](), [Exploit]() Tags: [apt](), [exploit](), [infostealer](), [initial-access](), [malware](), [phishing](), [rat](), [social-engineering](), [spoofing](), [trojan](), [zero-day]() ### AI overview Huntress examines a DarkMe campaign in which a VB6 remote access trojan and infostealer was delivered through social engineering rather than an exploit. The campaign used a malicious PIF presented as an image, illustrating how threat actors can use simpler initial-access methods. ### Source excerpt DarkMe, an APT-linked VB6 RAT known for using zero day exploits, turned up in two Huntress incidents stripped down to a plain .pif infostealer malware.