Threat Actors

Profiling adversary groups targeting AI systems and leveraging AI in their operations.

May 18, 2026 4 min read

GhostCircuit Ransomware: AI Victim Recon

GhostCircuit is a RaaS operation that integrated LLM tooling into its post-compromise reconnaissance, dramatically reducing time from initial access to ransomware deployment.

img of PHANTOM NEXUS: LLM-Augmented Threat Actor

May 17, 2026 5 min read

Threat Actors

PHANTOM NEXUS: LLM-Augmented Threat Actor

A newly tracked cluster uses LLMs to automate spear phishing, accelerate vulnerability research, and generate disinformation targeting AI researchers and ML engineers.