CYBERSHIELD Threat Intelligence Team
Wizard Cyber's first line of defence in proactive threat intelligence. The team is dedicated to the identification, monitoring and analysis of emerging cyber threats, including activity across the dark web, underground forums and threat actor infrastructure. Leveraging advanced threat intelligence platforms, OSINT tooling and adversary tracking methodologies, the team provides actionable intelligence to anticipate attacks before they occur. With expertise in threat actor profiling, TTP mapping aligned to the MITRE ATT&CK framework, and IOC enrichment, it equips clients with the insight needed to fortify defences, mitigate risk and stay ahead of an evolving threat landscape. The team works across Wizard Cyber's security operations centres, each manned around the clock in its own right rather than handing over to the next region. Wizard Cyber has run Microsoft Sentinel since 2019 and is a Microsoft Solutions Partner.
16 articles
Seven Agencies, One Mailbox-Theft Playbook: Hunting AA26-281A In Microsoft 365
A joint advisory co-sealed by NCSC-UK shows password spraying across ten Exchange interfaces, then mail theft via EWS and app secrets. How to hunt it.
Threat ResearchExchange Server CVE-2026-96940: Patch The Mailbox-Read Flaw Before It's Weaponised
An out-of-band fix for on-prem Exchange closes a flaw that lets one compromised user read other mailboxes. Who must act, and how to hunt for it.
Threat ResearchBrevo Supply Chain Attack: One API Key, 100,000 Websites
A hardcoded Cloudflare API key let attackers rewrite Brevo's scripts at the edge, pushing ClickFix and a hidden WordPress backdoor to around 100,000 sites.
Threat ResearchPlugin4Shell: A Zero-Click RCE In Four AI Coding Agents
Four AI coding agents checked out a pinned commit without verifying it landed. A branch named like the hash delivers malicious code, and the pin still looks intact.
Threat ResearchInterlock Ransomware: TTPs and Detection Guide
Interlock uses hybrid RSA-AES encryption, symlink abuse and log clearing. Its TTPs, and the KQL to detect them in Defender XDR.
Threat ResearchDetecting Allowed Malicious Traffic Past the Firewall
Blocked threats get the attention. The more revealing question is what the firewall flagged and let through anyway — and how to find it.
Threat ResearchTeams Helpdesk Impersonation: Detecting Cross-Tenant Attacks
Attackers impersonate IT helpdesk in Teams, talk users into remote access, and reach domain controllers in one session. Eleven detections for it.
Threat ResearchClickFix and HijackLoader: Detecting DeerStealer Attacks
How ClickFix and HijackLoader deliver DeerStealer through user execution, MSI abuse and DLL sideloading — with the hunt query to find it.
Threat ResearchDetecting Successful Brute Force in Entra ID
Most brute force alerting fires on failures. This detection finds the successes — correct passwords used from the wrong place, with the KQL.
Threat ResearchDetect Suspicious External Domains in Microsoft Teams
How to detect suspicious external domains in Microsoft Teams using Sentinel and Defender XDR, with the KQL and the baselining logic behind it.
Threat ResearchCVE-2025-55241 – Azure Entra Elevation Of Privilege Via Actor Token Vulnerability
A flaw in Entra ID meant any user account could be escalated to Global Administrator. Patched before disclosure — and still the most instructive Entra bug of the year.
Threat ResearchHow SVG Files Are Weaponized in Phishing Attacks
SVG files look like images but can carry JavaScript. How attackers use them to bypass email filters, and what actually stops it.
Threat ResearchDumping System Secrets While EDR Is Running
Blocking the obvious tool is not the same as preventing the technique. Why SAM, SYSTEM and SECURITY remain reachable with EDR running, and what actually detects it.
Threat ResearchWeaponizing Screen Savers: A Deep Dive Into SCR File Exploitation
A .scr file is nominally a screen saver and actually a Windows executable. Why that distinction is an attack vector, why detection struggles with it, and how to shut it down.
Threat ResearchCOM Hijacking: Enhancing Red Team Persistence Strategies
A fileless persistence technique that needs no admin rights and leaves almost no forensic trace. How COM hijacking works, why it is hard to see, and the registry telemetry that catches it.
Threat ResearchEscaping a Docker Container: An Attacker's Perspective
A container is not a security boundary by default. How an over-privileged container becomes a host compromise, which capabilities actually matter, and how to detect and prevent it.
Talk to the people
who do the work.
A demo against your own estate rather than a canned one, run by an analyst rather than a salesperson.