Browse public community intelligence reports, source analysis, and threat research.
3 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
Chinese-speaking threat actor knaithe utilizes the Hermes Agent framework and DeepSeek LLM to orchestrate autonomous vulnerability research, target enumeration, and exploitation attempts against global infrastructure.
Likely state-sponsored actor CL-STA-1132 is exploiting a zero-day buffer overflow (CVE-2026-0300) in PAN-OS Captive Portal to achieve root-level remote code execution.
