Browse public community intelligence reports, source analysis, and threat research.
40 intel reports
The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.
An operator exfiltrated over 68 GB of SQL Server backups from a Philippine government agency and staged a rebranded GodPotato tool named Wrqsnx on an open directory.
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
Russian-speaking actors NyashTeam and Kapchenka operate Salat Stealer (WEB_RAT), a Go-based MaaS targeting Windows for credential and cryptocurrency theft.
Ransomware actors Spikey Scorpius and Tarnished Scorpius are exploiting an authentication bypass in PAN-OS GlobalProtect (CVE-2026-0257) to gain initial access, bypass MFA, and pivot to virtualization infrastructure.
Qilin and INC ransomware groups are exploiting CVE-2026-0257 in PAN-OS to bypass MFA and pivot into VMware virtualization environments for offline credential dumping.
Ransomware actors including Spikey Scorpius and Tarnished Scorpius are exploiting CVE-2026-0257 to bypass MFA and gain initial access to corporate networks via PAN-OS VPNs.
Threat actor TeamPCP executed a massive supply chain campaign compromising GitHub Actions from Aqua Security and Checkmarx, VS Code extensions, and npm packages to deploy a multi-stage credential stealer and a self-propagating worm.
Akira ransomware targets global organizations across Windows and Linux platforms using double extortion, vulnerability exploitation, and credential theft.
