Campaign Cards

Campaign: A coordinated set of related threat activity tied together by time, objective, infrastructure, tools, vulnerabilities, victims, or associated actors.

Search campaigns

Presets

Search Results / Output

Campaigns / Operations

Campaign results are loaded from the database campaign corpus.

100 campaigns

Associated Campaign / Operation

ScreenConnect Exploitation and Storm-1175 / Medusa Operations^[1]

Campaign updated Jul 18, 2026

3 actors

Mapped Actors^[1]

Storm-1175 · Medusa · Unattributed ScreenConnect operators

Threat Types

Campaign · ScreenConnect · ConnectWise · Storm-1175

Initial Access

Valid Accounts · Edge Exploitation · Remote Access

Target Sectors

Cross-industry · Managed Service Providers · SMBs · Healthcare · Professional Services · Technology

Target Countries / Exposure

Global · United States · Global exposure · source reporting does not support a complete country list

ATT&CK IDs

T1190 · T1098 · T1078 · T1003 · T1021 · T1562.001

Summary

This card connects two source-bounded layers: broad multi-actor exploitation of the 2024 ScreenConnect authentication-bypass and path-traversal flaws, and Microsoft’s later named Storm-1175 campaign chain in which vulnerable web-facing assets, including ScreenConnect, can lead to credential theft, lateral movement, data exfiltration, security tampering, and Medusa ransomware. It does not assert that every 2024 ScreenConnect intrusion was Storm-1175 activity.

Evidence Basis / Claim Status

February 2024 through July 18, 2026 · Cross-source reconciliation of vendor remediation, government KEV status, incident-response observations, and Microsoft campaign telemetry · Multiple Huntress-observed 2024 intrusions plus Microsoft-observed Storm-1175 operations; no universal victim count asserted · Exploitation and named campaign chain confirmed; actor and victim conclusions remain source- and incident-specific

IntelliOS Intel Products

PANDA Flash Threat Intel BriefScreenConnect Exploitation Creates MSP-to-Customer Ransomware Exposure

Open campaign detail >

Associated Campaign / Operation

ClickFix Campaign Impacting WordPress^[1]

Campaign updated Jul 18, 2026

2 actors

Mapped Actors^[1]

KongTuke · Unidentified ClickFix operators

Threat Types

Campaign · ClickFix · WordPress · Social Engineering

Initial Access

Phishing

Target Sectors

Cross-industry · Technology · Education · Healthcare · Media · Local businesses

Target Countries / Exposure

Global · United States · United Kingdom · Australia · Brazil · Canada

ATT&CK IDs

T1189 · T1204.004 · T1059.001 · T1105 · T1555

Summary

Multiple operations compromise legitimate WordPress sites and use fake CAPTCHA or Cloudflare-style verification prompts to persuade Windows users to copy and run attacker-supplied commands. The website is the delivery point; the visitor endpoint becomes the execution and credential-theft target.

Evidence Basis / Claim Status

Late 2024 through July 2026 · Cross-source synthesis of vendor incident observations, campaign research, ATT&CK technique mapping, and official WordPress hardening guidance · Multiple public research clusters; Rapid7 alone identified more than 250 infected sites across at least 12 countries in its observed operation · Technique and delivery pattern confirmed; actor attribution and victim impact remain source- and case-specific

IntelliOS Intel Products

PANDA Flash Threat Intel BriefClickFix Campaign Impacting WordPress

Open campaign detail >

Associated Campaign / Operation

FortiBleed Credential Exposure Campaign^[3]

Campaign updated Jul 9, 2026

2 actors

Mapped Actors^[3]

INC Ransom · Lynx

Threat Types

Campaign · Credential Exposure · Ransomware · Fortinet

Initial Access

No normalized initial-access classification retained

Target Sectors

Technology · Information Services · Manufacturing · Professional Services

Target Countries / Exposure

United States · Global

ATT&CK IDs

T1190 · T1133 · T1078 · T1552 · T1486

Summary

FortiBleed is retained as a Fortinet/FortiGate credential-exposure campaign in which public reporting tied exposed or stolen Fortinet edge credentials to downstream ransomware activity involving INC Ransom and Lynx. IntelliOS treats FortiBleed as a campaign/operation context rather than proof that every exposed Fortinet environment was compromised or deployed with ransomware.

IntelliOS Intel Products

Flash Threat Intel BriefFortiBleed Fortinet Credential Exposure One-Page Cheat SheetSophos Firewall VPN Bruteforcing and FortiBleed Advisory

Open campaign detail >

Rows per page(3 cards)

1-3 of 100

Source of Trust / Citations

Campaign Data Sources

Campaign mode uses campaign and operation sources rather than actor-only profile sources. SOCRadar and MITRE provide the baseline campaign corpus; IntelliOS links retained campaigns to published PANDA briefs when a campaign overlaps an existing static intel product.

Baseline Retained Sources

#	Tier	Publisher	Published	Why Used	Source
1	Tier 1	SOCRadar	Live campaign database	Baseline public campaign corpus for campaign names, aliases, associated actors, target context, campaign taxonomy, and source-backed campaign metadata when rows are available.	Campaigns https://socradar.io/free-tools/campaigns
2	Tier 0	MITRE ATT&CK	Reference framework	Canonical campaign framework used for campaign IDs, ATT&CK technique relationships, campaign descriptions, associated groups/software, and campaign-to-actor boundary checks.	Campaigns https://attack.mitre.org/campaigns/
3	Tier 1	IntelliOS PANDA	Published static briefs	Links campaign cards to existing IntelliOS flash briefs and actor snapshots such as FortiBleed, Klue, Salesloft Drift, and Icarus when the campaign context overlaps a published product.	Linked IntelliOS Intel Products /vault

Expansion / Consensus Sources

#	Tier	Publisher	Published	Why Used	Source
4	Tier 1	Google / Mandiant	Campaign and threat research	Consensus and enrichment source for campaign mechanics, actor/campaign boundaries, SaaS/OAuth intrusion context, vishing, extortion, victimology caveats, and deconfliction.	Threat Intelligence Research https://cloud.google.com/blog/topics/threat-intelligence
5	Tier 1	Microsoft Threat Intelligence	Threat research	Planned campaign enrichment source for Microsoft-tracked campaigns, actor naming, cloud identity activity, malware/tooling, IOCs, and defensive guidance.	Threat Intelligence Blog https://www.microsoft.com/en-us/security/blog/topic/threat-intelligence/
6	Tier 1	CrowdStrike	Threat research	Planned campaign and adversary cross-checking source for naming conventions, intrusion sets, victimology, malware/tooling, and campaign boundary reconciliation.	Adversary Universe https://www.crowdstrike.com/en-us/adversaries/
7	Tier 1	FBI / CISA / Government Advisories	Public advisories	Authoritative public advisories for campaign-level warnings, sector risk, defensive actions, infrastructure/IOC releases, and source-backed law-enforcement context.	Cybersecurity Advisories https://www.cisa.gov/news-events/cybersecurity-advisories

Change Log

Campaign Cards

v0.3 / last updated Jul 17, 2026

AI agents maintain these card systems by checking source updates, correlating records, preserving source boundaries, and writing visible audit notes when the database or presentation changes.

Preset selection state added

Jul 17, 2026

Selected campaign presets now remain visibly highlighted and rename the card album and results headings until a manual search, filter change, or reset clears the preset.

Campaign cards linked to IntelliOS products

Jul 10, 2026

FortiBleed and Salesforce/Klue campaign rows now surface related IntelliOS static briefs and actor snapshots where applicable.

Campaign corpus created

Jul 9, 2026

Added database-backed campaign cards, campaign detail pages, actor mappings, ATT&CK fields, citations, and no-result card behavior.

Page 1 / 1

CARDS

Loading Campaign Cards

Campaign Cards

v0.3Last updated Jul 17, 2026Last AI Agent update: N/A

Versa Director Zero Day Exploitation

Campaign +7

Mapped actors: Volt Typhoon

Managed Service Providers +12

Water Curupira Pikabot Distribution

Campaign +3

Mapped actors: Attribution not specified in seed source

Cross-industry +10

ScreenConnect Exploitation and Storm-1175 / Medusa Operations

Campaign +9

Mapped actors: Storm-1175 · Medusa +1

Cross-industry · Managed Service Providers · SMBs +12

Open campaign detail

ClickFix Campaign Impacting WordPress

Campaign +6

Mapped actors: KongTuke · Unidentified ClickFix operators

Cross-industry +10

FortiBleed Credential Exposure Campaign

Campaign +4

Mapped actors: INC Ransom · Lynx

Technology +8

Campaign cards are database-backed records linking operations, mapped actors, ATT&CK techniques, targeting, and source citations.

Definition

Campaign: A coordinated set of related threat activity tied together by time, objective, infrastructure, tools, vulnerabilities, victims, or associated actors.

Search campaigns

Presets

Search Results / Output

Campaigns / Operations

Campaign results are loaded from the database campaign corpus.

100 campaigns

Associated Campaign / Operation

ScreenConnect Exploitation and Storm-1175 / Medusa Operations^[1]

Campaign updated Jul 18, 2026

3 actors

Mapped Actors^[1]

Storm-1175 · Medusa · Unattributed ScreenConnect operators

Threat Types

Campaign · ScreenConnect · ConnectWise · Storm-1175

Initial Access

Valid Accounts · Edge Exploitation · Remote Access

Target Sectors

Cross-industry · Managed Service Providers · SMBs · Healthcare · Professional Services · Technology

Target Countries / Exposure

Global · United States · Global exposure · source reporting does not support a complete country list

ATT&CK IDs

T1190 · T1098 · T1078 · T1003 · T1021 · T1562.001

Summary

Evidence Basis / Claim Status

IntelliOS Intel Products

PANDA Flash Threat Intel BriefScreenConnect Exploitation Creates MSP-to-Customer Ransomware Exposure

Open campaign detail >

Associated Campaign / Operation

ClickFix Campaign Impacting WordPress^[1]

Campaign updated Jul 18, 2026

2 actors

Mapped Actors^[1]

KongTuke · Unidentified ClickFix operators

Threat Types

Campaign · ClickFix · WordPress · Social Engineering

Initial Access

Phishing

Target Sectors

Cross-industry · Technology · Education · Healthcare · Media · Local businesses

Target Countries / Exposure

Global · United States · United Kingdom · Australia · Brazil · Canada

ATT&CK IDs

T1189 · T1204.004 · T1059.001 · T1105 · T1555

Summary

Evidence Basis / Claim Status

IntelliOS Intel Products

PANDA Flash Threat Intel BriefClickFix Campaign Impacting WordPress

Open campaign detail >

Associated Campaign / Operation

FortiBleed Credential Exposure Campaign^[3]

Campaign updated Jul 9, 2026

2 actors

Mapped Actors^[3]

INC Ransom · Lynx

Threat Types

Campaign · Credential Exposure · Ransomware · Fortinet

Initial Access

No normalized initial-access classification retained

Target Sectors

Technology · Information Services · Manufacturing · Professional Services

Target Countries / Exposure

United States · Global

ATT&CK IDs

T1190 · T1133 · T1078 · T1552 · T1486

Summary

IntelliOS Intel Products

Flash Threat Intel BriefFortiBleed Fortinet Credential Exposure One-Page Cheat SheetSophos Firewall VPN Bruteforcing and FortiBleed Advisory

Open campaign detail >

Rows per page(3 cards)

1-3 of 100

Source of Trust / Citations

Campaign Data Sources

Baseline Retained Sources

#	Tier	Publisher	Published	Why Used	Source
1	Tier 1	SOCRadar	Live campaign database	Baseline public campaign corpus for campaign names, aliases, associated actors, target context, campaign taxonomy, and source-backed campaign metadata when rows are available.	Campaigns https://socradar.io/free-tools/campaigns
2	Tier 0	MITRE ATT&CK	Reference framework	Canonical campaign framework used for campaign IDs, ATT&CK technique relationships, campaign descriptions, associated groups/software, and campaign-to-actor boundary checks.	Campaigns https://attack.mitre.org/campaigns/
3	Tier 1	IntelliOS PANDA	Published static briefs	Links campaign cards to existing IntelliOS flash briefs and actor snapshots such as FortiBleed, Klue, Salesloft Drift, and Icarus when the campaign context overlaps a published product.	Linked IntelliOS Intel Products /vault

Expansion / Consensus Sources

#	Tier	Publisher	Published	Why Used	Source
4	Tier 1	Google / Mandiant	Campaign and threat research	Consensus and enrichment source for campaign mechanics, actor/campaign boundaries, SaaS/OAuth intrusion context, vishing, extortion, victimology caveats, and deconfliction.	Threat Intelligence Research https://cloud.google.com/blog/topics/threat-intelligence
5	Tier 1	Microsoft Threat Intelligence	Threat research	Planned campaign enrichment source for Microsoft-tracked campaigns, actor naming, cloud identity activity, malware/tooling, IOCs, and defensive guidance.	Threat Intelligence Blog https://www.microsoft.com/en-us/security/blog/topic/threat-intelligence/
6	Tier 1	CrowdStrike	Threat research	Planned campaign and adversary cross-checking source for naming conventions, intrusion sets, victimology, malware/tooling, and campaign boundary reconciliation.	Adversary Universe https://www.crowdstrike.com/en-us/adversaries/
7	Tier 1	FBI / CISA / Government Advisories	Public advisories	Authoritative public advisories for campaign-level warnings, sector risk, defensive actions, infrastructure/IOC releases, and source-backed law-enforcement context.	Cybersecurity Advisories https://www.cisa.gov/news-events/cybersecurity-advisories

Change Log

Campaign Cards

v0.3 / last updated Jul 17, 2026

AI agents maintain these card systems by checking source updates, correlating records, preserving source boundaries, and writing visible audit notes when the database or presentation changes.

Preset selection state added

Jul 17, 2026

Selected campaign presets now remain visibly highlighted and rename the card album and results headings until a manual search, filter change, or reset clears the preset.

Campaign cards linked to IntelliOS products

Jul 10, 2026

FortiBleed and Salesforce/Klue campaign rows now surface related IntelliOS static briefs and actor snapshots where applicable.

Campaign corpus created

Jul 9, 2026

Added database-backed campaign cards, campaign detail pages, actor mappings, ATT&CK fields, citations, and no-result card behavior.

Page 1 / 1

Campaign Cards

Campaigns / Operations

ScreenConnect Exploitation and Storm-1175 / Medusa Operations[1]

ClickFix Campaign Impacting WordPress[1]

FortiBleed Credential Exposure Campaign[3]

Campaign Data Sources

Campaign Cards

Preset selection state added

Campaign cards linked to IntelliOS products

Campaign corpus created

Loading Campaign Cards

Campaign Cards

Campaigns / Operations

ScreenConnect Exploitation and Storm-1175 / Medusa Operations[1]

ClickFix Campaign Impacting WordPress[1]

FortiBleed Credential Exposure Campaign[3]

Campaign Data Sources

Campaign Cards

Preset selection state added

Campaign cards linked to IntelliOS products

Campaign corpus created

ScreenConnect Exploitation and Storm-1175 / Medusa Operations^[1]

ClickFix Campaign Impacting WordPress^[1]

FortiBleed Credential Exposure Campaign^[3]

ScreenConnect Exploitation and Storm-1175 / Medusa Operations^[1]

ClickFix Campaign Impacting WordPress^[1]

FortiBleed Credential Exposure Campaign^[3]