Browse public community intelligence reports, source analysis, and threat research.
7 intel reports
GhostFrame is an ESXi post-exploitation framework that Recorded Future observed in TAG-218 activity overlapping with Settra ransomware operations.
Adversaries such as ShinyHunters are exploiting known vulnerabilities and unsecured remote access services to target the healthcare sector, leading to significant ransomware impacts and clinical disruptions.
Attackers are exploiting CVE-2026-65400, a critical macOS Screen Sharing authentication bypass, to gain root access and deploy Monero miners on internet-exposed systems.
China-aligned threat actor ITG27 (Mustang Panda) is targeting the Indian government and energy sector using updated Toneshell v10 and a new VNC-capable backdoor named Havencode.
Unidentified threat actors are exploiting a critical macOS Screen Sharing authentication bypass (CVE-2026-65400) to gain root access and deploy Monero miners.
OnyxC2 is a sophisticated Malware-as-a-Service info-stealer and remote access toolkit targeting over 200 applications including crypto wallets, browsers, and 2FA extensions.
The CrystalX RAT is a sophisticated Malware-as-a-Service platform written in Go that combines traditional spyware, credential theft, and unique 'prankware' capabilities to target users globally.
