Threat Intel Content Update: 4/15/25

Trellix Advance Research Center Partnership, Voice Phishing Threats

Threat Objects

• Exciting news as we launch a threat content partnership with the Trellix Advanced Research Center! This week, we released nearly 100 new Group & Software objects authored by the Trellix team to Tidal’s global knowledge base, helping fill existing gaps around timely threats including active ransomware, hacktivist, and espionage groups. Objects can be filtered by the “Source” column in the Group, Software, or Campaign list pages via the main navigation menu – look for “Trellix TIG” to surface new objects and use them in your research, matrices, and Threat Profiles.

Threat Profiles & Objects

• • “Trending & Emerging Threats” weekly update: Voice Phishing Threats
    • This profile includes threat objects leveraging the Spearphishing Voice techniques (T1598.004 for Reconnaissance & T1566.004 for Initial Access). These relatively new Techniques have been leveraged notably in recent times, with incident responders very recently highlighting an uptick in activity from groups like CHATTY SPIDER, for whom voice phishing is a hallmark.
    • The large majority of threats linked to T1598.004 & T1566.004 in our global knowledge base were authored by Tidal. This profile is especially helpful for prioritizing among the myriad post-compromise TTPs associated with these threats.