Browse public community intelligence reports, source analysis, and threat research.
105 intel reports
The Gentlemen Ransomware-as-a-Service (RaaS) group utilizes a sophisticated EDR-killing framework and targets global organizations using leaked Fortinet VPN credentials.
A low-privileged user can coerce the Windows Store Install Service (SYSTEM) to perform NTLM authentication or execute arbitrary DLLs via UNC-located loose-file package registration.
CVE-2026-22778 allows remote attackers to execute arbitrary code on vLLM servers by chaining a heap address leak with a JPEG2000 decoder overflow in the video processing stack.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
An unidentified threat actor is using the VAPT offensive framework to hijack misconfigured Ollama AI servers for automated vulnerability scanning, exploit generation, and credential theft.
A critical pre-authentication vulnerability in Splunk's PostgreSQL Sidecar Service allows unauthenticated attackers to achieve remote code execution through chained exploitation of path traversal and unsafe database parameters.
A critical vulnerability chain named SearchLeak allows attackers to exfiltrate sensitive Microsoft 365 data via a single-click URL exploit targeting Copilot Enterprise Search.
The Gentlemen ransomware, operated by the Phantom Mantis group (LARVA-368), has evolved from a RaaS affiliate into an independent operation featuring AI-assisted development and a self-propagating worm module.
ITScape (CVE-2026-46316) is a high-severity guest-to-host escape vulnerability in KVM/arm64's vGIC-ITS emulation caused by a race condition leading to a double-put use-after-free.
Chaotic Eclipse is leveraging zero-day vulnerabilities YellowKey and MiniPlasma to bypass BitLocker and achieve SYSTEM-level privilege escalation on Windows 11 and Server environments.
