Browse public community intelligence reports, source analysis, and threat research.
94 intel reports
Threat actors are exploiting an unauthenticated remote code execution vulnerability in Langflow (CVE-2026-33017) to deploy a multi-stage Monero cryptomining toolchain and spread via SSH key reuse.
A cryptocurrency-mining campaign exploits CVE-2026-33017, an unauthenticated RCE in Langflow, to deploy a Go-based miner with aggressive defense evasion and lateral movement capabilities.
SilverFox actors are utilizing a multi-stage loader chain masquerading as Panasonic and Philips software to deploy Sauron/Gh0stRAT backdoors via Alibaba OSS infrastructure.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
A sophisticated multi-stage batch dropper uses PowerShell and VBScript to execute obfuscated payloads, perform DLL hijacking, and establish redundant C2 communications.
Kimsuky APT utilizes a multi-stage JScript loader to deploy the NUKESPED backdoor, targeting South Korean entities through social engineering lures.
A campaign using Amazon-themed phishing and ClickFix social engineering to deliver the HarborWatch Agent RAT, managed via the Harbor Sentinel Chinese-language admin panel.
A highly sophisticated multi-stage npm supply chain campaign targeting Red Hat and AI-related packages uses GitHub as an adaptive C2 to deploy the Shai-Hulud infostealer variant 'Miasma'.
JS.MonoGlyphRAT is a persistent JScript backdoor targeting US technology, MSSP, and telecom sectors using monoglyph-obfuscated scripts and encrypted PowerShell stagers.
A critical argument injection vulnerability in Gogs allows authenticated users to achieve RCE by injecting the --exec flag into git rebase during pull request operations.
