Browse public community intelligence reports, source analysis, and threat research.
36 intel reports
UNC3753 (Silent Ransom Group) targets US legal and financial services using vishing to deploy RMM tools and, in some cases, physical office intrusions to exfiltrate data via USB.
BlackSuit ransomware operators conducted a 15-day intrusion involving Kerberoasting, lateral movement via SMB and RDP, and persistence through SystemBC before final encryption.
Comprehensive analysis of Active Directory exploitation techniques including NTLM relaying, Kerberos delegation abuse, and AD Certificate Services vulnerabilities.
The threat actor k0t (aka CryptoFeel) is mass-exploiting edge appliances via CVE-2025-64446 and CVE-2026-0257 to steal credentials and facilitate ransomware attacks.
Qilin (aka Agenda) is a high-volume Russian-speaking RaaS operation targeting global manufacturing and healthcare sectors through credential abuse and advanced EDR evasion.
Akira ransomware targets global organizations across Windows and Linux platforms using double extortion, vulnerability exploitation, and credential theft.
Akira ransomware affiliates utilize RDP for initial access, ProcDump for credential theft, and GOST tunnels for persistence before deploying Rclone for exfiltration and encrypting data.
Ransomware groups including CHAOS, Medusa, and Gunra are increasingly targeting radiology departments and healthcare providers using double-extortion and extortion-only tactics.
The Go-based ClosedQuorum malware utilizes multiple commercial AI models to autonomously select post-compromise actions, including credential dumping and process injection, without human operator intervention.
Storm-2570 is a versatile ransomware affiliate utilizing consistent post-compromise tools like MeshAgent, ntdsutil, and s5cmd to deploy multiple ransomware families including Qilin and DragonForce.
