Intel Exchange

APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.

Threat actors are attempting to weaponize critical PHP2Shell vulnerabilities to deploy the Potassium Mirai variant for large-scale DDoS attacks against Ukrainian targets.

SafePay ransomware actors target global critical infrastructure by exploiting edge device vulnerabilities and using legitimate administrative tools for data exfiltration and hybrid encryption.

The threat actor k0t (aka CryptoFeel) is mass-exploiting edge appliances via CVE-2025-64446 and CVE-2026-0257 to steal credentials and facilitate ransomware attacks.

An unknown threat actor is infecting Magento e-commerce stores with scanner-evading JavaScript loaders via malicious CMS blocks to target shoppers.

Ransomware actors Spikey Scorpius and Tarnished Scorpius are exploiting an authentication bypass in PAN-OS GlobalProtect (CVE-2026-0257) to gain initial access, bypass MFA, and pivot to virtualization infrastructure.

The suspected PRC-nexus actor ARMORY CASTLE exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to deploy custom SAWFLY webshells and BARECLAW tunnelers for credential theft and lateral movement.

Qilin and INC ransomware groups are exploiting CVE-2026-0257 in PAN-OS to bypass MFA and pivot into VMware virtualization environments for offline credential dumping.

Chinese-speaking and English-speaking threat actors are using the Cairn AI penetration testing tool to automate vulnerability discovery and web shell deployment against global e-commerce and retail targets.

Threat actor CL-UNK-1211 and other groups are leveraging AI agents and LLM-generated code to discover zero-days and orchestrate rapid exploitation campaigns against Linux infrastructure.