The 2026 Threat Detection Report is packed with brand-new sections on the AI trends we’re seeing in the wild. 🤖🛡 From AI-powered threats to AI infrastructure risks, these are the priorities every security leader needs to prioritize. Our experts break down everything you’ll find in this year's report right here 👉 bit.ly/4rAVtDR

Read our liner notes to see which threats, techniques, and trends these songs pair with! redcanary.com/threat-detecti…

If you’re waiting for a breach to learn how adversaries move, you’re already behind. 📉 We’ve crunched the numbers, analyzed the latest techniques, and built the ultimate guide to keeping your environment safe. The 2026 Red Canary Threat Detection Report is dropping soon! bit.ly/4s9PSoT

What a year 2025 has been! From relentless threat detection to excitedly joining the Zscaler family, it has been a busy year for the Red Canary team. We're looking back at the most beloved and informative content we brought you, the cybersecurity community, throughout 2025 in this "best of" list. Explore our top picks here ➡️ bit.ly/49itKly

The "Sticky Bandits" of cybercrime are out there waiting for an opportunity to wreak havoc. Your cloud security strategy needs a bit of Kevin McCallister's legendary proactive defense! ➡️ Click here before your cloud gets hit with a paint can: bit.ly/3Y7M2Q5

The @CISAgov is strongly encouraging organizations to patch a critical-severity Windows Server Update Services (WSUS) vulnerability (CVE-2025-59287) after adding it to its catalog of Known Exploited Vulnerabilities (KEV Catalogue). On servers with WSUS Server Role enabled and ports open to 8530/8531, adversaries can leverage specially crafted requests to exploit a deserialization of untrusted data vulnerability that allows for remote code execution. This can lead to PowerShell and Windows Command Shell executing base64 encoded commands designed to enumerate users and network information on affected endpoints. While Microsoft has issued guidance for mitigating this vulnerability, including releasing an out-of-band security update for impacted Windows Server versions, some organizations may not be able to patch immediately. Red Canary has detected post exploitation activity related to this vulnerability through the following detection analytics: 𝐀𝐛𝐮𝐬𝐞 𝐨𝐟 𝐖𝐢𝐧𝐝𝐨𝐰𝐬 𝐜𝐨𝐦𝐦𝐚𝐧𝐝 𝐬𝐡𝐞𝐥𝐥 𝐟𝐨𝐫 𝐞𝐱𝐞𝐜𝐮𝐭𝐢𝐨𝐧 Security teams could detect this activity by looking for 𝙘𝙢𝙙.𝙚𝙭𝙚 being spawned from the Windows Server IIS worker process (𝙬3𝙬𝙥.𝙚𝙭𝙚) or the WSUS service binary (𝙬𝙨𝙪𝙨𝙨𝙚𝙧𝙫𝙞𝙘𝙚.𝙚𝙭𝙚), with a /𝙘 command that starts another 𝙘𝙢𝙙.𝙚𝙭𝙚 /𝙘 instance. bit.ly/3L4bliW 𝐀𝐛𝐮𝐬𝐞 𝐨𝐟 𝐏𝐨𝐰𝐞𝐫𝐒𝐡𝐞𝐥𝐥 𝐭𝐨 𝐨𝐛𝐟𝐮𝐬𝐜𝐚𝐭𝐞 𝐜𝐨𝐦𝐦𝐚𝐧𝐝𝐬 Another detection opportunity involves looking for the use of the shortened encodedCommand flag in 𝙋𝙤𝙬𝙚𝙧𝙎𝙝𝙚𝙡𝙡. Adversaries often try to obfuscate the use of malicious code on an endpoint, wrapping them up for PowerShell to execute. bit.ly/4nv9YqJ

Based on all the Easter eggs, we were expecting Taylor's new album to be called "The Life of a SOC analyst." But we're excited for this new era nonetheless! ❤️‍🔥 👩‍💻 Revisit @Susannigans's blog on why Swifties should work in cybersecurity: bit.ly/4liqUjb

🐣 A new color bird threat has hatched! Mocha Manakin employs paste and run with PowerShell to drop a custom NodeJS backdoor that could lead to ransomware. ☕ Read our breaking research for detection opportunities and more technical details on this Red Canary-named threat. bit.ly/4lbRpXR

📣 The 2025 Threat Detection Report is here! Dive into our analysis of 93,000 threats our customers' security controls missed, with actionable guidance on every page. Read the ungated report here: redcanary.com/threat-detecti…

The 2025 Threat Detection Report is almost here! Here's preview of this year's Threat sounds playlist. 🎧 Can you guess which MITRE ATT&CK technique we paired with Taylor Swift's "I Look in People's Windows?" What about "Sharpest Tool" by Sabrina Carpenter? 🎤 Sound off in the comments! open.spotify.com/playlist/2G…

📢 The 2025 Threat Detection Report is coming! We're bringing you a year’s worth of security operations and threat intelligence insights distilled into one actionable report. Be one of the first to read it by signing up here: redcanary.com/resources/guid…

Seasoned defenders are likely familiar with the CIA triad: Crystal balls, Incense, and Astrology. 🔮 ✨ ♎ In an effort to foretell the adversary tradecraft your security operations team will encounter next year, we decided to look to the stars. 🔭 redcanary.com/blog/security-…