Browse public community intelligence reports, source analysis, and threat research.
124 intel reports
Fedora 43 has released critical security patches for Request Tracker version 5.0.10, addressing seven vulnerabilities that could lead to unauthorized access or execution.
Threat actors are actively exploiting a decade-old improper access control vulnerability in ProFTPD's mod_copy module to achieve unauthenticated remote code execution on Linux/Unix systems.
Lazarus Group targets global financial services and cryptocurrency sectors using supply chain compromises and trojanized software to fund the North Korean regime.
The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).
The Cling botnet exploits multiple IoT vulnerabilities to deploy a worm-like malware that repurposes legitimate STUN traffic and infrastructure for command-and-control communications.
The Brazilian threat actor Exilware utilizes the BraZetsu framework and Hestia Control Panel infrastructure to operate an initial access marketplace targeting Latin American organizations.
Adversaries leverage ClickFix social engineering, ClearFake etherhiding, and SNEAKY2FA AiTM phishing to deliver malware and hijack sessions.
The Iranian state-aligned actor CL-STA-1178 is conducting the 'Blinder Tunnel' campaign targeting Iraqi critical infrastructure using trojanized coding challenges and living-off-the-cloud TTPs.
ClingSTUN is a Linux back-connect proxy backdoor that exploits numerous IoT vulnerabilities and abuses public STUN infrastructure for NAT traversal and remote command execution.
An unauthenticated attacker can achieve remote code execution on Rejetto HFS by exploiting a predictable PRNG to forge administrator sessions.
