Browse public community intelligence reports, source analysis, and threat research.
5 intel reports
Threat actors are exploiting a remote code execution vulnerability in REDCap servers (CVE-2026-90817) to deploy XMRig miners using fileless techniques and steganography.
Longlegs (aka Storm-2603), a China-nexus threat actor, is deploying Warlock ransomware against critical infrastructure and government sectors by exploiting SharePoint 'ToolShell' vulnerabilities.
The ClickFix campaign compromised a regional news outlet using malicious JavaScript to deliver social engineering prompts that lead to the execution of an encrypted .NET infostealer.
The wp2shell exploit chain leverages vulnerabilities in WordPress Core's REST API and WP_Query to achieve unauthenticated remote code execution on default installations.
Threat actors are using vishing and Microsoft Teams screen-sharing to impersonate corporate IT support and deploy the blockchain-anchored EtherRAT malware.
