Stanislav Stoychev

Inside CyberSift’s TDUC lifecycle for turning emerging threats into high-confidence detections. A new attacker technique can become yesterday’s problem surprisingly quickly. Identity abuse, supply-chain compromise, AI-assisted attacks and techniques such as ClickFix are evolving faster than traditional detection-development cycles. MITRE’s 2026 ATT&CK updates reflect the same reality, with more frequent updates to capture emerging groups, software and attack activity. For a security...

Why attackers now target security controls before encrypting data For years, ransomware was viewed as a simple equation: attackers gain access, encrypt files, and demand payment. Organizations invested heavily in backups and endpoint protection with the assumption that preventing encryption was the primary objective. That assumption no longer reflects how modern ransomware operates. Today’s ransomware groups increasingly focus on weakening defenses before deploying their final payload. They...

FortiGate Devices Under Increased Attack: What Organizations Need to Know Over the past several months, Fortinet customers have faced a series of security incidents involving FortiGate firewalls. Recent campaigns have demonstrated how quickly threat actors can move from initial access to full administrative control of a device, often creating unauthorized accounts, modifying firewall configurations, and establishing persistent access before organizations realize they have been compromised....