Browse public community intelligence reports, source analysis, and threat research.
23 intel reports
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
Akira ransomware targets global organizations across Windows and Linux platforms using double extortion, vulnerability exploitation, and credential theft.
China-aligned threat actor TA419 is conducting credential phishing campaigns against U.S. AI policy experts using Adversary-in-the-Middle (AitM) techniques and a customized Frameless BitB kit.
Iranian state cyber actors are using CHOSEN BRICK, a Windows-based spyware, to monitor dissidents and activists through social engineering and Telegram-based command and control.
The North Korean WaterPlum group uses fake job interviews and malicious development tools to compromise IT professionals, stealing over $10.7 million in cryptocurrency.
An unidentified ransomware-related threat actor is using SloppyRAT, a new multi-stage malware, to establish network footholds via ClickFix lures and blockchain-based C2 resolution.
China-aligned actor FamousSparrow is targeting Latin American governments with SparroWocky, a sophisticated C++ backdoor featuring advanced anti-analysis and modular execution capabilities.
PREY-0058 (UNC6671) uses help-desk vishing and AiTM phishing to steal Microsoft 365 session tokens for bulk data exfiltration from SharePoint and Exchange via residential proxies.
Russian-speaking threat actors are exploiting a heap-based buffer overflow (CVE-2025-25249) in FortiGate devices to deploy PivotC2, an AI-assisted Node.js RAT for network tunneling and credential theft.
The BlueKit threat actor group is conducting a sophisticated Phishing-as-a-Service campaign targeting financial sector CEOs using browser-in-the-middle techniques and post-authentication ScreenConnect delivery.
