Experienced a breach?
Contact us
Experienced a breach?
CONTACT US
Resource Type
Blog
Threat Reports and Advisories
Guides and tools
Datasheet
Webinars
Topics
Cloud
Incident Response
OT Security
Malware
Vulnerabilities
Attack Techniques
Detection
State Actors
Research
Forensics
Email
Cyber Crime
Ransomware
Mitigation and Response
Managed Detection and Response
Tabletop War Games
Threat Intelligence
Security Mitigation
VMware Security
Artificial intelligence (AI)
Threat Research
Blog Threat Reports and Advisories Attack Techniques Ransomware Threat Research
Fire Ant Evolves: From Hypervisors to Trusted Infrastructure
First reported in 2025, Fire Ant remained active into 2026. Explore how the threat actor expanded beyond hypervisors into trusted infrastructure, compromising routers, authentication systems, and Linux management hosts to maintain covert access, collect credentials and traffic, and reach connected high-value environments.
Sygnia Team
27.08.2026
35 min
Threat Reports and Advisories Attack Techniques Detection Incident Response Malware Threat Research
Shai-Hulud Returns: When Software Trust Becomes the Attack Surface
The August 2026 Shai-Hulud campaign was more than another npm compromise, it reflected the evolution of software supply chain attacks, where build pipelines and trust mechanisms have become high-value targets.
Omer Kidron, Enterprise Security Expert
Lahav Meir, Senior Enterprise Security Expert
5.08.2026
11 min
Blog Threat Intelligence Threat Research
When Technical Controls Work, Attackers Change the Rules: How a Failed Intrusion Became a Data Exposure Incident
Discover how a failed intrusion quickly became a data exposure incident after a threat actor pivoted from blocked technical attacks to social engineering, and why layered defenses, rapid response, and operational safeguards are essential when attackers change the rules.
Karin Lagziel
12.07.2026
6 min
Blog Ransomware Threat Intelligence Threat Research
Ransomware Incident Response in 2026: What Has Changed and What CISOs Are Still Getting Wrong
Learn what has changed in ransomware incident response in 2026, and what CISOs are still getting wrong
Rena Stern
12.07.2026
19 min
Blog Threat Intelligence Threat Research
Inside an AI-Assisted Cloud Attack: Familiar Techniques at Unfamiliar Speed
Learn how a threat actor used AI to accelerate a cloud attack from initial access to broad compromise in just 72 hours
Sergey Kozyrev, Eldar Goren, Arsela Rama, Liad Minster, Asaf Saada
29.06.2026
21 min
Blog Threat Intelligence Threat Research
Why 73% of Organizations Still Aren’t Ready for a Cyberattack
Explore lessons from Sygnia's 2026 CISO Survey on Incident Response Readiness.
Rena Stern
28.06.2026
7 min
Blog Threat Intelligence Threat Research
Crypto Security in 2026: Why Transaction Authority Is the Most Important Security Control
Most crypto breaches occur when attackers reach transaction authority. Learn how to secure identities, infrastructure, and authorization systems.
Rena Stern
18.06.2026
7 min
Blog Threat Intelligence Threat Research
Incident Response Metrics That Actually Matter to Boards (And the Ones That Don’t)
Learn which incident response metrics boards actually need to make decisions, and which ones create false confidence.
Rena Stern
27.05.2026
16 min
Blog Threat Intelligence Threat Research
8 Incident Response Plan Mistakes That Lead to Failures
Learn the 8 critical incident response mistakes that leave 73% of organizations unprepared, and how to close the execution gaps that turn manageable cyber incidents into full-scale business crises.
Rena Stern
12.05.2026
14 min
Blog Incident Response Threat Intelligence Threat Research
How to Leverage an Incident Response Retainer
Discover how to get the most from an incident response retainer, and what sets apart a provider that can respond effectively when your organization is under real pressure.
Rena Stern
24.03.2026
13 min
Blog Threat Intelligence Threat Research
Exfiltration in Plain Sight: SafePay’s OneDrive Play
Discover how SafePay’s rapid, high-pressure ransomware campaigns unfold, and what Sygnia learned while investigating a real-world double extortion attack that put a global organization to the test.
Jake Legumina
10.03.2026
8 min
Blog Threat Intelligence Threat Research
Incident Response in the AI Threat Era: What Boards Must Re-Evaluate in 2026
Explore how AI-driven cyber threats are reshaping board-level risk decisions and what executives must re-evaluate for incident response in 2026.
Rena Stern
8.03.2026
10 min
Solutions
Blog Threat Intelligence Threat Research
What 2025’s Major Cyber Incidents Taught Executives About Incident Response Readiness
Discover what Threat Detection, Investigation & Response (TDIR) means for modern enterprises, including frameworks, risks, and executive-level decision insights.
Rena Stern
15.02.2026
11 min
Blog Threat Reports and Advisories Attack Techniques Ransomware Threat Research
Fire Ant: A Deep-Dive into Hypervisor-Level Espionage
Sygnia investigated Fire Ant, a stealthy cyber-espionage campaign targeting VMware ESXi, vCenter, and network appliances. The attackers used hypervisor-level techniques to evade detection and maintain persistent access.
Sygnia Team
24.07.2025
18 min
Blog Threat Reports and Advisories Attack Techniques Forensics Incident Response Ransomware Threat Research
Weaver Ant, the Web Shell Whisperer: Tracking a Live China-nexus Operation
Sygnia details Weaver Ant, a China-nexus threat actor infiltrating a major telecom provider. Using web shells and tunneling, the attackers maintained persistence and facilitated cyber espionage. This blog explores their tactics and provides key defense strategies against state-sponsored threats.
Weaver Ant, the Web Shell Whisperer: Tracking a Live China-nexus Operation
24.03.2025
18 min
subsctibe decor
Want to get in touch?
Contact us