Browse public community intelligence reports, source analysis, and threat research.
368 intel reports
UNC6240 (ShinyHunters) exploited CVE-2026-35273 as a zero-day to target Oracle PeopleSoft infrastructure, primarily in the higher education sector, for data exfiltration and extortion.
A sophisticated multi-stage batch dropper uses PowerShell and VBScript to execute obfuscated payloads, perform DLL hijacking, and establish redundant C2 communications.
The suspected Muddywater (APT28 variant) actor is deploying the Moodleuni C2 RAT using a fake Inno Setup installer to establish persistence via COM registration and startup shortcuts.
Makop ransomware utilizes AES+RSA encryption and aggressive anti-recovery techniques such as deleting volume shadow copies and backup catalogs to target diverse Windows environments.
The Ethereum Loader is a sophisticated multi-stage malware that uses blockchain-based C2 communication and masquerades as VMware components to evade detection.
The Reynolds ransomware group utilizes the NSecKrnl kernel driver to terminate EDR processes and employs double-extortion tactics against enterprise targets.
A likely Iran-nexus activity cluster is deploying BLUERABBIT, a Golang-based backdoor that utilizes RabbitMQ, Redis, and MinIO for C2 and exfiltration prior to disk wiping and ransomware deployment.
Kimsuky APT utilizes a multi-stage JScript loader to deploy the NUKESPED backdoor, targeting South Korean entities through social engineering lures.
An unprivileged FreeBSD user can achieve local root access by exploiting a page-cache corruption vulnerability via kTLS-RX and the sendfile(2) system call.
A campaign using Amazon-themed phishing and ClickFix social engineering to deliver the HarborWatch Agent RAT, managed via the Harbor Sentinel Chinese-language admin panel.
