Browse public community intelligence reports, source analysis, and threat research.
247 intel reports
A suspected Russian-speaking actor used an AI-assisted toolkit (PentAGI) to exploit PaperCut vulnerabilities (CVE-2026-81578, CVE-2026-82078) and maintain persistence access across 45+ countries.
The Shai-Hulud worm compromised the tensorlake npm package to exfiltrate secrets and cryptocurrency browser data while implementing a destructive 'dead-man's switch' upon token revocation.
Threat actors abuse Microsoft Teams external chat to pose as IT support, using email bombing and vishing to deploy remote access tools and malware.
DPRK-linked actors are utilizing ErrTraffic ClickFix lures on compromised WordPress sites alongside fake recruiter personas to deliver Node.js-based RATs with Polygon-hosted C2 resolvers.
Flax Typhoon and RedTail botnet operators are repurposing legacy infrastructure to target newer vulnerabilities like XWiki and PHP-CGI across worldwide organizations.
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
The ROMULUS delivery platform utilizes ClickFix lures and social engineering to distribute diverse payloads including LegionLoader, Atlas RAT, and RomulusLoader targeting global organizations.
Threat actors are attempting to weaponize critical PHP2Shell vulnerabilities to deploy the Potassium Mirai variant for large-scale DDoS attacks against Ukrainian targets.
An unknown threat actor is infecting Magento e-commerce stores with scanner-evading JavaScript loaders via malicious CMS blocks to target shoppers.
