Intel

MCP (Model Context Protocol) is emerging as a standard interface for connecting LLM agents to developer tools and APIs. From GitHub workflows to CLI utilities, early adopters like Claude Code and Cursor are using MCP to let agents trigger real-world actions. But as the adoption grows, comes a critical question: How secure are these integrations?…

A few months ago, when the KubeCon London program committee selected my talk for Platform Engineering Day and scheduled it for April 1, I thought it was a prank. It turns out it wasn’t. As I stood on stage delivering my talk, “Platform Abstractions: An Asset or Liability?” I realized how much the platform engineering…

China-linked hackers used patented spyware tech from front companies tied to Hafnium, exposing gaps in cyber threat attribution. Executive Summary SentinelLABS identified 10+ patents for highly intrusive forensics and data collection technologies that were registered by companies named in U.S. indictments as working on behalf of the Hafnium threat actor group. These technologies offer strong,…

Organizations are increasingly relying on AI/ML models for essential functions. The convergence of AI with cloud-based infrastructure provides unprecedented opportunities, but also introduces significant risks, including data breaches, model theft, and regulatory compliance violations. Consider a typical AI deployment journey: Imagine an AI model lifecycle from early data collection and training to deployment and continuous…

NimDoor shows how threat actors are continuing to explore cross-platform languages that introduce new levels of complexity for analysts. Executive Summary DPRK threat actors are utilizing Nim-compiled binaries and multiple attack chains in a campaign targeting Web3 and Crypto-related businesses. Unusually for macOS malware, the threat actors employ a process injection technique and remote communications…

Traditional infrastructure often struggles to meet compute-intensive processing demands, unpredictable resource demands, and the data velocity of complex AI models. An AI cloud, particularly a GPU-based cloud platform, overcomes these shortcomings by offering extremely elastic computational resources, high-performance storage, and scalable infrastructure optimized for both AI training and inference. In contrast to generic compute-based traditional…

This report uncovers a set of related threat clusters linked to PurpleHaze and ShadowPad operators targeting organizations, including cybersecurity vendors. Executive Summary In October 2024, SentinelLABS observed and countered a reconnaissance operation targeting SentinelOne, which we track as part of a broader activity cluster named PurpleHaze. At the beginning of 2025, we also identified and…

Artificial intelligence (AI) has become a critical component of modern business operations. As it becomes more prevalent, making the right infrastructure decision, on-premises, in the cloud, or a hybrid of both, has become essential. This decision has significant implications for cost, scalability, security, and compliance. According to the Evans Data report, nearly 9.7 million developers…

FreeDrain is a modern, scalable phishing operation exploiting weaknesses in free publishing platforms to steal cryptocurrency on a global scale. Executive Summary FreeDrain is an industrial-scale, global cryptocurrency phishing operation that has been stealing digital assets for years. FreeDrain uses SEO manipulation, free-tier web services (like gitbook.io, webflow.io, and github.io), and layered redirection techniques to…