- Company
Silent Push Inc. ©2025
How a Fortune 500 media company blocked a Scattered Lapsus ShinyHunters attack using infrastructure flagged 24 hours before it launched
Industry: Media and Entertainment
Role: Security Operations
Use case: Indicators of Future Attack, adversary infrastructure enumeration, firewall blocking, campaign monitoring
A Fortune 500 media and entertainment company stopped a Scattered Lapsus ShinyHunters attack in real time, because Silent Push had already flagged the infrastructure one day before the attack launched.
+24hrs
Early warning
Silent Push flagged the domain before the attack launched
100%
Infrastructure mapped
Full adversary infrastructure enumerated and pushed to firewall within minutes
2
Attempts blocked
Second attack blocked before it reached an employee
Scattered Lapsus ShinyHunters: how they operate
Scattered Lapsus ShinyHunters is a financially motivated threat actor group responsible for breaches at some of the largest organisations in the world. Their approach combines repeatable social engineering with bulletproof hosting infrastructure and lookalike domains built for credential harvesting.
Their tactics are well documented. Their infrastructure is not. It is built fresh for each campaign, stood up close to the time of the attack, and designed to avoid detection by tools that rely on historical indicators. Tracking it requires visibility into adversary infrastructure during the staging phase, before the campaign goes live.
The incident
The threat actor placed a call to an employee at the organisation, directing them to a lookalike domain impersonating a passkey authentication flow. The domain was live and the attack was in progress.
The organisation’s existing tooling, CrowdStrike, caught the outbound connection attempt in firewall logs. The team ran it through Silent Push to confirm it was an IOFA. The domain was blocked, but the immediate question was larger: how much infrastructure had Scattered Lapsus ShinyHunters already staged for this campaign? Were other employees being targeted via different domains at the same time?
Without visibility into the adversary’s full infrastructure, there was no way to know.
The domain was already flagged
Silent Push had identified the domain one day before the attack launched. It was part of a known bulletproof hosting cluster, tracked and tagged in a Silent Push Indicators of Future Attack® feed. The domain had been flagged as adversary infrastructure before the threat actor placed the call.
When the outbound connection appeared in the team’s environment, they used Silent Push to enumerate the full infrastructure Scattered Lapsus ShinyHunters had staged for the campaign. Every related domain was identified and pushed into their CrowdStrike firewall within minutes.
Second attempt, already blocked.
Fifteen minutes after the initial domain was blocked, the same group attempted a second social engineering attack against a different employee using a different domain. That domain was already blocked. The attempt failed before it reached the employee.
The team then used Silent Push to monitor every domain the group had staged for the campaign on an ongoing basis, ensuring no further attempts would reach anyone in the organisation.
IOCs vs IOFAs: what the difference looks like in practice
Traditional threat feeds deliver indicators of compromise: forensic evidence of what happened after a breach. By the time an IOC is published and ingested, the event it describes has already occurred. The infrastructure has often been rotated or taken down.
Silent Push delivers Indicators of Future Attack®: signals from adversary infrastructure being built before it is used. In this case, that meant a domain flagged inside a bulletproof hosting IOFA feed, 24 hours before the threat actor used it in an active campaign.
That window, between infrastructure being staged and infrastructure being weaponised, is where preemptive defense is actually possible. The domain was known and the cluster was mapped. When the attack launched, the response was already in place.
To see how Silent Push IOFA feeds and the broader platform works in practice, book a demo with our platform experts.
Early Attack Warning Signals for AI and Agentic Security
Your AI SOC assistant is only as sharp as the intelligence you hand it.
Security teams have begun integrating AI-assisted tools directly into their detection and investigation workflows. While that’s a good instinct, an agent is only as good as its inputs, and most detection data describes attacks that are already underway. Feed a fast, capable AI model stale signals, and it will draw fast, capable, but wrong conclusions.
Earlier, we established the core idea behind Silent Push’s Context Graph: adversaries have a preparation phase. Most security tooling is watching the wrong part of the timeline. Using Indicators of Compromise (IOCs), they wait until an attack has been launched before saying anything. Indicators of Future Attack® (IOFA) close the gap, surfacing adversary infrastructure while it’s still being staged.
The Silent Push Context Graph continuously maps how DNS, WHOIS, certificate, and hosting data change across the internet, turning those patterns into IOFA/early attack warning signals that reveal adversary infrastructure weeks before it’s weaponized.
A new question to explore is what happens when that intelligence feeds directly into the agentic workflows security teams are already building?
The Data Problem Nobody’s Solving
AI-assisted investigation tools are proliferating faster than the intelligence feeding them is improving. A model can summarize an indicator, pivot on an IP, or draft an incident timeline in seconds. What it can’t do is invent good data. If the underlying signal is unvalidated, stale, or missing the infrastructure an adversary hasn’t deployed yet, the agent’s output inherits every one of those gaps, just faster and with more confidence.
Silent Push maps adversary infrastructure continuously across DNS, IP ranges, behavioral fingerprints, and web content, scanning hundreds of millions of data points to surface IOFA before a campaign goes live. That’s the raw material, and what’s added now is a direct line from that data into the tools practitioners are already using to investigate.
Bringing Early Attack Warning Signals into the Workflow
The Silent Push MCP Server, released in version 6.0, lets practitioners query Context Graph intelligence in plain language directly inside Claude, Cursor, and other MCP-compatible platforms. Threat investigations, indicator enrichment, infrastructure pivots, and IOC validation all run through the same interface that a team already has open. There’s no new syntax to learn and no separate tool to context-switch into.
SOC and CTI teams have plenty of tools; their biggest strain is the seams between them. Every additional platform is another login, another export, and another place context gets lost in translation. An MCP-compatible workflow removes a seam instead of adding one.
Why the Underlying Data Has to Hold Up
None of this works if the data behind it is soft. The Context Graph is built on validated signals grounded in observed infrastructure behavior, avoiding inference and guesswork, and backed by clear data provenance for every result.
Backed with 200+ API endpoints, it’s built for automated enrichment from day one, so whether a query comes from an analyst typing a question in plain English or a script pulling data on a schedule, it’s drawing from the same validated source. An agentic workflow built on that foundation enables practitioners to act immediately.
Fitting the Stack You Already Have
None of this requires ripping out existing tooling. We integrate directly into Splunk, Palo Alto XSOAR, Swimlane, Tines, ThreatConnect, Torq, Sumo Logic, and more, feeding IOCs, domain and IP reputation scoring, and SPQL-powered queries into the SIEM and SOAR workflows teams already run. The MCP Server extends the same data into AI-assisted investigation without asking anyone to change how they work.
Silent Push sits alongside the stack a team already has and fills the specific gap that stacks leave open: infrastructure-level visibility in the weeks before an attack deploys. By the time a traditional IOC is published, the staging infrastructure behind it has usually already moved on.
Speed without validated data is just faster guessing.
Lead Time Is Critical
In May 2025, we identified the staging domains behind what would become the Salt Typhoon campaign. The first public reports of intrusions followed in July, two months later. That gap between staging and disclosure is exactly the window most detection stacks can’t see into, and it’s the window an agentic workflow built on Context Graph data can act inside.
The Effect on Your Role
SOC Leads
We feed your SIEM and SOAR with pre-validated, infrastructure-level context, so your team can detect adversary infrastructure while it’s still being built. The MCP Server brings that same intelligence into the investigation tools your analysts already have open, without adding a platform to your stack.
IR Leads
When an incident opens, the first question is always scope. We map an adversary’s staging infrastructure from a single indicator, so your team sees the campaign on day one and can focus on remediation rather than reconstruction.
CTI Leads
Attribution data arrives before a campaign goes live. The Context Graph maps adversary staging infrastructure and surfaces IOFA ahead of deployment. The MCP Server lets you pivot on fingerprints and cluster infrastructure, track threat actor patterns in plain language, and export straight to your TIP without leaving the workflow.
The CISO
By narrowing your exposure window, we give your team a defensible position before a threat activates. This translates into board-ready metrics: threats blocked before launch and incidents that never reached the perimeter.
Interested in Learning More?
Start a conversation with one of our platform experts to learn how preemptive cyber defense can give your team more lead time on adversary infrastructure, before an attack is launched.
We also offer a free Community Edition so defenders can see how our platform integrates with their existing security stack.
FAQs
What is AISEO?
AI Search Engine Optimization, or AISEO, is the strategic practice that uses AI tools and ML algorithms to adapt websites and content so that AI language models (such as ChatGPT, Claude, Gemini, Google AI Overviews, Grok, Perplexity, and more) can easily understand, extract, and cite one’s information. It does this at speeds (and depths) that vastly surpass manual workflows. AISEO is also referred to as “Generative Engine Optimization.”
Unlike traditional SEO, which focuses on keyword density and backlinks to get users to click links, AISEO optimizes content to be quoted directly by AI.
