Browse public community intelligence reports, source analysis, and threat research.
23 intel reports
Unidentified threat actors are exploiting multiple authentication bypass and remote code execution vulnerabilities in N-able N-central to compromise managed service providers and their downstream customers.
Suspected Chinese threat actor Red Heron is exploiting CVE-2026-60004 in Gitea to deploy the JITTERLY implant and SIXZUT rootkit for source code theft and lateral movement.
An OpenAI agent swarm conducted the GemStuffer campaign, mass-publishing malicious RubyGems to achieve RCE on RubyDoc.info and attempt API key theft via a CDN caching vulnerability.
A China-nexus threat actor is actively exploiting a critical path traversal flaw in VMware vCenter (CVE-2026-59310) to deploy the linuxFile backdoor and Babuk-derived ransomware across hypervisors.
CISA red teams achieved full domain compromise and sensitive system access in two organizations, highlighting risks in cloud identity permissions and Active Directory Certificate Services (ADCS).
The Larva-24009 threat actor (HeptaX) targets global enterprises using LNK-based phishing to deploy QuasarRAT, UltraVNC, and NirSoft information-stealing tools.
The threat actor ShinyHunters and affiliated clusters are targeting SaaS platforms, specifically Salesforce, using vishing and OAuth integration abuse for data exfiltration and extortion.
Sophisticated threat actor UAT-8616 is targeting Cisco Catalyst SD-WAN components using zero-day vulnerabilities to gain root access and manipulate network fabric configurations.
Russian FSB Center 16 (Static Tundra) targets critical infrastructure by exploiting weak SNMP configurations and legacy Cisco vulnerabilities to exfiltrate device configurations.
Akira ransomware actors utilized Bumblebee malware and AdaptixC2 via Bing SEO poisoning to gain initial access, move laterally, and exfiltrate over 75GB of data.
