Threat Actors

Profiling adversary groups targeting AI systems and leveraging AI in their operations.

May 19, 2026 3 min read

PhantomSynth: AI Spear Phishing at Scale

PhantomSynth is a financially motivated threat actor that has industrialised LLM-generated spear phishing, dramatically reducing the cost of targeted social engineering at scale.

img of GhostCircuit Ransomware: AI Victim Recon

May 18, 2026 4 min read

Threat Actors

GhostCircuit Ransomware: AI Victim Recon

GhostCircuit is a RaaS operation that integrated LLM tooling into its post-compromise reconnaissance, dramatically reducing time from initial access to ransomware deployment.

img of PHANTOM NEXUS: LLM-Augmented Threat Actor

May 17, 2026 5 min read

Threat Actors

PHANTOM NEXUS: LLM-Augmented Threat Actor

A newly tracked cluster uses LLMs to automate spear phishing, accelerate vulnerability research, and generate disinformation targeting AI researchers and ML engineers.