Browse public community intelligence reports, source analysis, and threat research.
241 intel reports
A Chinese-speaking threat actor (Asia-Pacific Group) is utilizing leaked DarkSword exploit kit source code to target iOS 18.4-18.7 devices using GHOSTBLADE malware.
The pro-Ukrainian threat actor Bearlyfy (Toy Ghouls) is targeting Russian organizations using their custom GenieLocker ransomware across Windows, Linux, and ESXi platforms.
Russia-aligned actor TA488 is leveraging a critical XSS vulnerability in Outlook Web Access to deploy OWAReaper, a sophisticated browser-based implant for persistent mailbox access.
Threat actors are actively exploiting critical deserialization vulnerabilities in on-premises Microsoft SharePoint Server to achieve remote code execution and maintain persistence via machine key theft.
Cl0p ransomware affiliates are exploiting a critical RCE vulnerability (CVE-2026-12569) in PTC Windchill and FlexPLM systems to deploy JSP webshells and exfiltrate data.
Wiz Research discovered CosmosEscape, a critical vulnerability in Azure Cosmos DB's Gremlin API allowing full cross-tenant read/write access to databases via a platform-wide master key.
JadeProx is a China-nexus threat cluster targeting Southeast Asia and Latin America using TriBack Loader and various tunneling tools for cyber espionage.
Russia-aligned threat group UAC-0099 is delivering a multi-stage infection chain involving LUNCHPOKE, BURNYBEAR, and MATCHBOIL.V2 by abusing legitimate Notepad++ plugin loading routines.
An authenticated attacker with repository write access can achieve remote code execution by exploiting an add/add collision in Gitea's diffpatch endpoint to plant a malicious Git hook.
An authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC) allows remote, unauthenticated attackers to execute commands and gain root access via crafted HTTP requests.
