
Arctic Wolf Labs
In-depth security, R&D, and threat intelligence for Arctic Wolf’s customer base and the security community at large.
Enriching the Arctic Wolf Aurora Platform
Arctic Wolf Labs brings together elite security researchers, data scientists, and security development engineers together to help end cyber risk for organizations around the globe.
Leveraging trillions of security events the Arctic Wolf Security Operations Cloud ingests, parses, enriches, and analyzes each week.
Arctic Wolf Labs:

Delivers cutting-edge threat intelligence and security research on new and emerging adversaries
New detection developments for sophisticated threats and zero-days vulnerabilities.

Develops advanced threat detection models aided by machine learning and artificial intelligence
Scalable and effective threat hunting by using both human analysis and automations to provide actionable insights.

Drives continuous improvement in the speed, scale, and detection efficacy of Arctic Wolf solutions
Augment our solutions with Security Analytics and Machine Learning (ML) developments.
Capabilities
Creating technology and solutions that will secure customers today and into the future.
Strategic Research and Tactical Investigations
- Threat Actor Behaviors
- Threat Actor Tactics, Techniques, and Procedures (TTPs)
- Vulnerabilities and Exploits
- Malware and Ransomware Analysis
Operational Detections and Communication
- New Detection Methods
- Indicators of Compromise (IoCs)
- Threat Hunting Leads
Cross-Vertical Application Threat Intelligence
- Intelligence developed to address vertical concerns that is then applied cross-functionally to additional industries
Expertise
The Arctic Wolf Labs team encompasses decades worth of collective research knowledge, with achievements including:
Publications by Arctic Wolf Labs covering Artificial Intelligence (AI) security applications
0
+
Patents covering cybersecurity methods for various communication systems, big-data, machine learning applications
0
+
Committee engagements including: NIST, TMLS, DEFCON, aggregate intellect
0
+
Publications on machine and deep learning, quantum mechanics, mathematics, and game theory
0
+
REPORT AVAILABLE!
2024 Arctic Wolf Labs Threat Report
Learn what’s new, what’s changed, and what’s ahead for the cybersecurity threat landscape with our in-depth research and observations.
Arctic Wolf Labs Threat Intelligence Research
Featured Observations

Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls

Cleopatra’s Shadow: A Mass Exploitation Campaign Deploying a Java Backdoor Through Zero-Day Exploitation of Cleo MFT Software
Strengthen Your Security Posture
with Arctic Wolf Labs
Security R&D for the preventative pillar of your information security program – for network, endpoint, and cloud.
How We Help:
Vulnerability Risk
Detections
Detections
- Create detections that scan and identify assets with vulnerable and out of date software and/or operating systems
- Help prioritize which assets should be patched first by leveraging relevant customer contexts and Arctic Wolf Labs threat intelligence
- vxIntel by Arctic Wolf - Malware intelligence platform enhances threat detection capabilities
- Explore our tools:
- Log4j (Log4Shell) Deep Scan Tool
- Spring4Shell Deep Scan Tool
Configuration Risk and System Hardening Detections
- Automated benchmarks highlight risky configurations that can be exploited on a range of asset types and operating systems
- Increased visibility into your public cloud resources, including AWS, GCP, and Azure, to reduce risk of misconfiguration through Cloud Security Posture Management
Security Community Involvement
- Major contributors to the Security Automation Protocol (SCAP) and Open Vulnerability Assessment Language (OVAL) working groups to enhance and increase adoption of a standard vulnerability definition language as leveraged by Arctic Wolf JOVAL engine
- Regularly provide patches and vulnerability insights as part of the Microsoft Patch Tuesday OVALs
- Provide open source-developed scanning tools in response to key major security events