This content requires premium access. Subscribe for full threat intelligence reports and analysis.
Premium
Premium content
SILENTLOOM: A Reused Device Pool Behind a Quiet Microsoft 365 Password Attack
Premium access required
silentloom
PremiumSILENTLOOM: A Reused Device Pool Behind a Quiet Microsoft 365 Password Attack
A partner pulled the source IPs behind a quiet, low-and-slow password attack on three Microsoft 365 accounts, and we ran both June waves through ClusterHawk. The pool is hijacked home and small-office gear across global telecoms, reused between waves (124 of 146 second-wave IPs), with a verified Airtel M360-P tracking marker.
silentloommicrosoft-365brute-forcebotnetiotinfrastructure-analysisthreat-intelligencethreat-huntingclusteringhunting-queries
MU
By Marvin Uku
06/07/2026
Related reports
Free
botnetiotproxy-network+4
When Your Router Becomes Someone Else's Weapon: Uncovering a 800+ Proxy Network via KeeneticOS Router
Through infrastructure clustering analysis, we identified a proxy network of 832 compromised KeeneticOS routers operating across Russian ISPs. The investigation shows how consumer routers get turned into weaponized infrastructure for threat actors.
KM
Karl Mendelman
26/11/2025
Free
doctrinemethodologyinfrastructure-analysis+6
Find the House, Not the Doormat: A Doctrine for Reading Infrastructure Metadata After the Attack
The single-indicator pivot dies against a tier-separated operator, stopping at the access surface. This doctrine proposes five moves for reading metadata after: seed a behavioral cohort, mine persistent fingerprints, separate attack signature from residue, judge on surrounding context, converge by independent method.
MU
Marvin Uku
18/06/2026
Free
eviltokensphishingdevice-code+7
EvilTokens: Device Code Phishing Goes Industrial
We fed 95 EvilTokens campaign IPs into ClusterHawk and mapped a four-tier architecture. It spans a Cloudflare CDN frontend, DocuSign/Exim backend hosting, a bridge cluster on Google Trust Services certs, Cobalt Strike C2 fronted through the CDN, and an unreported IoT layer of Hikvision/Dahua cameras.
MU
Marvin Uku
09/04/2026
Comments (0)
You need a premium subscription to view and participate in comments on threat intelligence posts.
