Browse public community intelligence reports, source analysis, and threat research.
64 intel reports
Russia-aligned actors Earth Dahu and SHADOW-EARTH-066 are exploiting a WinRAR path traversal vulnerability to deploy GIFTEDCROOK and espionage modules against Ukrainian organizations.
BlueNoroff is utilizing an advanced phishing kit to impersonate Zoom and Microsoft Teams, profiling cryptocurrency wallets before delivering tailored malware to high-value targets.
Kimsuky targeted South Korean groupware vendors to compromise downstream customers using new Gomir malware variants and credential harvesting techniques.
ClickLock Dev uses ClickFix social engineering and aggressive process-killing loops to steal credentials and crypto wallets from macOS users in Europe and North America.
An unknown Chinese-speaking APT group is targeting Russian critical sectors by exploiting the ViPNet update system to deploy a suite of malicious modules including HelloInjector and HelloProxy.
The threat actor Hyadina has rebranded Beast ransomware as GodDamn, utilizing the malicious PoisonX kernel driver to disable endpoint defenses via BYOVD attacks.
Turla (Secret Blizzard) targets government and military entities globally using the custom STOCKSTAY and Kazuar backdoors, often leveraging hijacked infrastructure.
The ChocoPoC threat actor is targeting security researchers with trojanized GitHub PoC repositories that install malicious PyPI packages to deliver a Python-based RAT.
Threat actors are exploiting an unauthenticated remote code execution vulnerability in Langflow (CVE-2026-33017) to deploy a multi-stage Monero cryptomining toolchain and spread via SSH key reuse.
Chinese-speaking threat actor CL-STA-1062 is targeting government and energy sectors in Southeast Asia using a custom .NET backdoor named TinyRCT.
