Browse public community intelligence reports, source analysis, and threat research.
47 intel reports
The threat actor JINX-0164 targets cryptocurrency industry developers using sophisticated macOS-specific malware, CI/CD compromise, and social engineering to steal digital assets and credentials.
The threat actor Storm-2949 leverages social engineering and SSPR abuse to compromise identities, pivoting to Azure control-plane operations for massive data exfiltration.
Likely state-sponsored actor CL-STA-1132 is exploiting a zero-day buffer overflow (CVE-2026-0300) in PAN-OS Captive Portal to achieve root-level remote code execution.
UNC5142 utilizes EtherRAT and the AI-generated TukTuk framework to conduct data exfiltration and deploy The Gentlemen ransomware via decentralized and SaaS infrastructure.
VECT 2.0 ransomware permanently destroys data in files larger than 128 KB due to a critical nonce-handling flaw across Windows, Linux, and ESXi platforms.
Threat actors compromised the axios npm package to deliver a multi-stage, cross-platform Remote Access Trojan (RAT) via a malicious dependency named plain-crypto-js.
The GhostClaw malware campaign has expanded its delivery from npm packages to malicious GitHub repositories and AI-assisted developer workflows to steal macOS credentials.
