threat actor

May 18, 2026 4 min read

GhostCircuit: The Ransomware Group Automating Victim Reconnaissance with AI

GhostCircuit is a ransomware-as-a-service operation that has integrated LLM-based tooling into its post-compromise reconnaissance phase, dramatically accelerating the time from initial access to ransomware deployment.

img of PHANTOM NEXUS: LLM-Augmented Group Targeting AI Developers

May 17, 2026 4 min read

Threat Actors

PHANTOM NEXUS: LLM-Augmented Group Targeting AI Developers

A newly tracked threat cluster is using large language models to automate spear phishing, accelerate vulnerability research, and generate synthetic disinformation targeting AI researchers and ML engineers at foundation model labs.