Intel Exchange

Browse public community intelligence reports, source analysis, and threat research.

Cover image for VAPOR PANDA AI-Driven ARTEX Global Espionage Campaign

VAPOR PANDA AI-Driven ARTEX Global Espionage Campaign

VAPOR PANDA is using the ARTEX agentic AI framework and DeepSeek LLM to conduct simultaneous global espionage against foreign ministries and critical infrastructure sectors.

avatar
ills3c Intel&Coffee@Ills3C2 days ago

4 intel reports

PoisonedRefresh Rootkit Exploiting CVE-2025-53521 on BIG-IP APM

Adversary c05d5254 uses the PoisonedRefresh rootkit to inject fileless PHP web shells into F5 BIG-IP APM memory via CVE-2025-53521 exploitation.

avatar
Kenji Choy@kchoy
27 days ago
12
Critical RCE Zero-Day in F5 BIG-IP APM

F5 BIG-IP APM is vulnerable to a critical unauthenticated remote code execution flaw (CVE-2026-94127) when configured as an OAuth Authorization Server, which is actively being exploited in the wild.

avatar
Kenji Choy@kchoy
2 months ago
64
PoisonedRefresh Rootkit Exploiting F5 BIG-IP APM CVE-2025-53521

Cluster c05d5254 utilizes the PoisonedRefresh rootkit to inject fileless PHP web shells into F5 BIG-IP APM memory via CVE-2025-53521 exploitation.

avatar
Kenji Choy@kchoy
2 months ago
12
PoisonedRefresh Exploits F5 BIG-IP via Memory-Injected Rootkit

An advanced threat actor, PoisonedRefresh, is exploiting CVE-2025-53521 in F5 BIG-IP systems to deploy a sophisticated Linux rootkit that injects in-memory PHP webshells.

avatar
Arnold Chan@slaz
2 months ago
20