Browse public community intelligence reports, source analysis, and threat research.
368 intel reports
Threat actors are exploiting CVE-2026-48558 in SimpleHelp RMM to deploy TaskWeaver, a modular Node.js loader, and Djinn Stealer, a cross-platform information stealer targeting developer and AI credentials.
The HellCat ransomware group is increasingly exploiting Jira credentials harvested by infostealers like StealC and Amadey to facilitate corporate breaches and data exfiltration.
The Shai-Hulud worm and GitRunner C2 framework abuse legitimate, digitally signed GitLab CI runner binaries as persistent backdoors to execute commands via CI/CD pipelines.
The VEIL#DROP framework utilizes Google's Blogspot platform and living-off-the-land binaries to deploy the PureLog Stealer in memory via a multi-stage fileless chain.
Mustang Panda targets Indian government and energy sectors using novel ZOHOMURK and MINIRECON implants delivered via DLL sideloading and cloud-based C2.
The Ousaban banking trojan utilizes geofenced phishing pages and steganography to target users in Spain and Portugal with remote access and credential theft capabilities.
Threat actors are exploiting an unauthenticated remote code execution vulnerability in Langflow (CVE-2026-33017) to deploy a multi-stage Monero cryptomining toolchain and spread via SSH key reuse.
Chinese-speaking threat actor CL-STA-1062 is targeting government and energy sectors in Southeast Asia using a custom .NET backdoor named TinyRCT.
The ShinyHunters extortion group is targeting Oracle PeopleSoft instances globally using a zero-day vulnerability (CVE-2026-35273) and credential spraying to steal data.
The Russia-linked Turla group is deploying STOCKSTAY, a multi-component .NET backdoor masquerading as benign utilities, to target government and military entities in Ukraine and Europe.
