Browse public community intelligence reports, source analysis, and threat research.
7 intel reports
A 3AM ransomware affiliate targeted a UK school estate using a hybrid operation where a human operator guided an agentic AI loop to execute repetitive lateral movement and domain trust configuration tasks.
A suspected China-nexus actor utilized an AI-assisted custom PHP2Shell exploit chain and Fragnesia kernel LPE to root 25 servers, including U.S. government-affiliated systems.
Akira ransomware targets global organizations across Windows and Linux platforms using double extortion, vulnerability exploitation, and credential theft.
CISA red teams achieved full domain compromise and sensitive system access in two organizations, highlighting risks in cloud identity permissions and Active Directory Certificate Services (ADCS).
Certighost (CVE-2026-54121) is a critical improper authorization vulnerability in AD CS allowing low-privileged users to impersonate Domain Controllers by abusing unverified directory referrals.
Akira ransomware actors utilized Bumblebee malware and AdaptixC2 via Bing SEO poisoning to gain initial access, move laterally, and exfiltrate over 75GB of data.
dMSA Ouroboros is a persistence technique in Windows Server 2025 that uses self-referencing GroupMSAMembership and Shadow Credentials to automate the extraction of NT hashes from superseded accounts.
