Mjolnir Security's threat intelligence and research blog. In-depth reports on emerging threat actors, active campaigns, malware analysis, and strategic advisories from our analyst team.
An unpatched local privilege escalation in Windows Defender that turns the antivirus itself into a SYSTEM-level arbitrary-write primitive. ~100% reliable on patched Win10/11/Server. Being paired in the wild with BlueHammer and UnDefend.
The .NET ransomware that destroyed data instead of encrypting it, leaked its builder to the world, and quietly became Yashma. Six versions, hundreds of variants, military contractor targeting.
650 sensor events. 9 named extortion victims. 429 0ktapus MFA-bypass events. Inside the most prolific data extortion operation of 2026 via MTAC telemetry.
Identity supply chain attack via compromised Context.ai OAuth integration. Attacker inherited refresh tokens, bypassed MFA, and exfiltrated production secrets without stealing a credential.