Browse public community intelligence reports, source analysis, and threat research.
105 intel reports
A vulnerability chain in OnePlus OxygenOS allows a no-permission malicious app to achieve full root access by exploiting AtlasService and a vendor-specific olc2 HAL.
The Russian-aligned Lunex Malware-as-a-Service platform utilizes a complex four-stage attack chain, including BYOVD-based EDR neutralization, to deploy a sophisticated information stealer and C2 agent.
The MikroTrick exploit chain combines an SSH state-machine flaw with a login argument injection bug to achieve unauthenticated administrative control over MikroTik RouterOS devices.
The researcher Nightmare Eclipse (aka MSNightmare) has released multiple proof-of-concept exploits targeting Windows Defender, Kaspersky, Avast, CrowdStrike, and NVIDIA drivers to achieve local privilege escalation or denial-of-service.
Chinese threat actor UTA0565 utilized chained Chrome and Windows zero-day exploits through spoofed domains to deliver a custom obfuscated malware named CLEANGULP targeting government entities.
Adversaries can achieve SYSTEM privilege escalation by planting a malicious DLL at a non-existent ProgramData path referenced by a dangling COM registration and triggering it via custom COM marshaling.
The Gentlemen threat actor group is utilizing the cross-platform TukTuk C2 framework and BYOVD techniques to neutralize EDR solutions while targeting global technology and healthcare sectors.
A financially motivated operator using the persona 'SOUL - Red Team Operator' employs autonomous AI harnesses (Hermes, Strix, Cairn) to breach online retailers, steal credit card data, and inject skimmer scripts.
INC Ransomware threat actors utilize Bring Your Own Vulnerable Driver (BYOVD) tactics and dual ransom notes to pressure victims after exfiltrating data via tools like MEGASync.
Chinese threat actors UTA0560 and JungleBamboo exploited a 'patch-gap' zero-day chain in Chrome and Windows to deploy the GRIMWEDGE backdoor and LONGTALE credential stealer.
