Bitsight analyzed thousands of posts across 16 underground communities and found rising discussion of AI tradecraft, especially agents, open-weight models, and attack infrastructure, alongside declines in ransomware and phishing mentions.
Bitsight profiles DragonForce’s ransomware operation, detailing its affiliate model, malware variants, attack techniques and reported incidents. The group is also recruiting technical specialists and offering analysis of stolen data to support extortion.
Critical infrastructure attacks can exploit exposed OT, vendor access, or weak credentials. The article recommends inventorying assets, removing direct internet exposure, segmenting networks, monitoring control systems, managing vendor access, and preparing for manual,;
BitSight describes threat actors using impersonation, denials and blame-shifting to confuse attribution. The article explains the risks for incident response and recommends verifying claims against preserved communications and technical evidence.