Browse public community intelligence reports, source analysis, and threat research.
241 intel reports
Threat actors are exploiting an unauthenticated remote code execution vulnerability in Langflow (CVE-2026-33017) to deploy a multi-stage Monero cryptomining toolchain and spread via SSH key reuse.
The ShinyHunters extortion group is targeting Oracle PeopleSoft instances globally using a zero-day vulnerability (CVE-2026-35273) and credential spraying to steal data.
Initial Access Broker Woodgnat (KongTuke) is deploying the Mistic and MLTBackdoor RATs via social engineering and compromised WordPress sites to sell network access to major ransomware affiliates.
A cryptocurrency-mining campaign exploits CVE-2026-33017, an unauthenticated RCE in Langflow, to deploy a Go-based miner with aggressive defense evasion and lateral movement capabilities.
RondoDox, TerraBot, and r00ts3c botnets are actively weaponizing legacy IoT vulnerabilities and modern enterprise flaws like Log4Shell using compromised residential infrastructure.
The Gentlemen Ransomware-as-a-Service (RaaS) group utilizes a sophisticated EDR-killing framework and targets global organizations using leaked Fortinet VPN credentials.
The ShinyHunters extortion group (UNC6240) is exploiting a critical remote code execution zero-day in Oracle PeopleSoft to breach over 100 organizations, primarily in the education sector.
UNC6508, a PRC-nexus threat actor, targets medical and military research institutions using INFINITERED malware to harvest credentials and exfiltrate data via manipulated compliance rules.
CVE-2026-22778 allows remote attackers to execute arbitrary code on vLLM servers by chaining a heap address leak with a JPEG2000 decoder overflow in the video processing stack.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
