Browse public community intelligence reports, source analysis, and threat research.
171 intel reports
The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.
SafePay ransomware actors target global critical infrastructure by exploiting edge device vulnerabilities and using legitimate administrative tools for data exfiltration and hybrid encryption.
The Gheist campaign utilizes stolen GitHub tokens to plant malicious workflows that exfiltrate secrets via base32-encoded logs, circumventing traditional security masks.
The suspected PRC-nexus actor ARMORY CASTLE exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to deploy custom SAWFLY webshells and BARECLAW tunnelers for credential theft and lateral movement.
KGB RAT is a Windows-based Malware-as-a-Service (MaaS) tool providing Remote Access Trojan capabilities, including credential theft, HVNC, ransomware, and cryptocurrency wallet swapping.
The threat actor RareWolf uses a multi-stage batch script to deploy AnyDesk for unauthorized remote access, archive local data, and exfiltrate information via SMTP using the Blat utility.
Cluster CL-STA-0954 (UNC5820) exploited multiple Fortinet vulnerabilities, including CVE-2024-47575 and CVE-2025-61624, to deploy a novel memory-resident ARM64 implant named PEERSTITCH against telecommunications providers.
CastleStealer and CastleLoader use browser protection bypasses and ClickFix social engineering to exfiltrate sensitive data and deploy secondary RATs like NetSupport.
Adversaries are actively exploiting multiple zero-day vulnerabilities in Citrix NetScaler ADC and Gateway to deploy persistence mechanisms including PHP-based webshells and remote management tools.
Kimsuky (APT-C-55) utilizes phishing emails with malicious LNK files and supply-chain poisoning of the 'pybroker' library to steal sensitive data from financial and research sectors.
