Browse public community intelligence reports, source analysis, and threat research.
247 intel reports
Threat actors including Slow Pisces and TeamPCP are increasingly exploiting Kubernetes vulnerabilities and misconfigured RBAC to escalate privileges and compromise cloud environments.
North Korean actor Sapphire Sleet compromised the popular Axios npm package to deliver platform-specific RATs via a malicious dependency named plain-crypto-js.
North Korean threat actor NICKEL ALLEY is targeting tech professionals via fake job interviews to deliver PyLangGhost RAT and BeaverTail malware through social engineering and malicious GitHub repositories.
A South Asian financial institution was targeted by an emerging actor using BRUSHWORM, a modular backdoor with USB spreading capabilities, and BRUSHLOGGER, a side-loaded keylogger.
A widespread initial access campaign using fraudulent human-verification prompts to trick victims into executing malicious commands via native system tools.
Attackers weaponized an unauthenticated RCE in Langflow within 20 hours of disclosure to exfiltrate credentials and deploy second-stage payloads.
An ongoing campaign, dubbed ForceMemo, compromises developer GitHub accounts to inject malware into Python repositories using a stealthy force-push technique and a Solana-based C2.
