<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>War Room</title>
	<atom:link href="https://warroom.rsmus.com/category/defense/rsm-defense/threat-intelligence/feed/" rel="self" type="application/rss+xml" />
	<link>https://warroom.rsmus.com</link>
	<description>Shells From Above</description>
	<lastBuildDate>Wed, 11 Mar 2026 21:05:51 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>https://warroom.rsmus.com/wp-content/uploads/2018/09/cropped-favicon-32x32.png</url>
	<title>War Room</title>
	<link>https://warroom.rsmus.com</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title>Fake Captcha Chains – Portable Behaviors, Practical Detections, And Field Notes</title>
		<link>https://warroom.rsmus.com/fake-captcha-chains/</link>
		
		<dc:creator><![CDATA[Justin Dolgos]]></dc:creator>
		<pubDate>Tue, 14 Oct 2025 18:28:19 +0000</pubDate>
				<category><![CDATA[Threat Intelligence]]></category>
		<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[Fake Captcha]]></category>
		<category><![CDATA[Fake Captcha Chains]]></category>
		<guid isPermaLink="false">https://warroom.rsmus.com/?p=6301</guid>

					<description><![CDATA[Executive Summary RSM Defense’s Threat Hunting Team performed a focused investigation after reviewing recent intelligence on the “Fake CAPTCHA” campaign. Our hypothesis was: “If the actor is in the environment, we may observe escaped or obfuscated PowerShell commands (for example h^t^t^p) used to download and stage payloads.” The hunt confirmed activity that occurred over a [&#8230;]]]></description>
		
		
		
			</item>
		<item>
		<title>Microsoft and HPE targeted by Cozy Bear in seemingly unrelated attacks</title>
		<link>https://warroom.rsmus.com/microsoft-and-hpe-targeted-by-cozy-bear-in-seemingly-unrelated-attacks/</link>
		
		<dc:creator><![CDATA[Morgan Kennedy]]></dc:creator>
		<pubDate>Mon, 29 Jan 2024 14:41:52 +0000</pubDate>
				<category><![CDATA[Threat Intelligence]]></category>
		<guid isPermaLink="false">https://warroom.rsmus.com/?p=6129</guid>

					<description><![CDATA[Over the past week, Microsoft and Hewlett Packard Enterprise (HPE) disclosed successful campaigns targeting the organizations by Russian-based threat actor Cozy Bear (aka Midnight Blizzard, aka APT29). Both campaigns conducted successfully obtained access to emails for both companies, including emails for senior leadership and cybersecurity positions.  Neither Microsoft nor HPE believe the attacks were related [&#8230;]]]></description>
		
		
		
			</item>
		<item>
		<title>Intel Insights &#8211; Phishing with QR Codes</title>
		<link>https://warroom.rsmus.com/phishing-with-qr-codes/</link>
		
		<dc:creator><![CDATA[Joel Belton]]></dc:creator>
		<pubDate>Fri, 25 Aug 2023 18:21:50 +0000</pubDate>
				<category><![CDATA[RSM Defense]]></category>
		<category><![CDATA[Threat Intelligence]]></category>
		<guid isPermaLink="false">https://warroom.rsmus.com/?p=6057</guid>

					<description><![CDATA[A large phishing campaign using QR codes has been detected targeting various industries, with the aim to acquire Microsoft credentials. Researchers from the security firm, Cofense, observed the attacks against “a major Energy company based in the US.” The reported phishing campaign also targeted organizations in other industries, including finance, insurance, manufacturing, and tech. One [&#8230;]]]></description>
		
		
		
			</item>
		<item>
		<title>Rhysida Ransomware Attack on PMH and Connections to Vice Society Ransomware</title>
		<link>https://warroom.rsmus.com/rhysida-ransomware-attack-on-pmh/</link>
		
		<dc:creator><![CDATA[Joel Belton]]></dc:creator>
		<pubDate>Fri, 11 Aug 2023 20:10:08 +0000</pubDate>
				<category><![CDATA[RSM Defense]]></category>
		<category><![CDATA[Threat Intelligence]]></category>
		<guid isPermaLink="false">https://warroom.rsmus.com/?p=6053</guid>

					<description><![CDATA[On August 4th, 2023, the parent company of Eastern Connecticut Health Network and Waterbury Health, Prospect Medical Holdings(PMH), announced that all of its facilities were facing IT complications. Prospect Medical Holdings is a parent company to over 16 hospitals, 165 outpatient clinics, in over 4 states ( California, Connecticut, Pennsylvania, Rhode Island) It was later [&#8230;]]]></description>
		
		
		
			</item>
	</channel>
</rss>
