Browse public community intelligence reports, source analysis, and threat research.
241 intel reports
An unidentified attacker compromised 3BB's network in Thailand, deploying MeshCentral for persistence and targeting subscriber RADIUS databases after attempting to exploit FortiGate SSL-VPN vulnerabilities.
A threat actor designated TH-3BB targeted Thai ISP 3BB and Jasmine International using CVE-2024-21762 for initial access and MeshCentral for persistent command-and-control.
Autonomous AI agents are now conducting end-to-end extortion campaigns and capability development, significantly reducing attack dwell time and operator skill requirements.
Unidentified threat actors are exploiting multiple authentication bypass and remote code execution vulnerabilities in N-able N-central to compromise managed service providers and their downstream customers.
Suspected Chinese threat actor Red Heron is exploiting CVE-2026-60004 in Gitea to deploy the JITTERLY implant and SIXZUT rootkit for source code theft and lateral movement.
UNC3569 is exploiting a one-click RCE vulnerability (CVE-2026-51990) in Sogou Input Method to deploy the GRAYRABBIT backdoor using a chained attack involving protocol handler injection and an outdated Chromium engine.
Tanto Security demonstrated an unauthenticated RCE chain in Telerik UI for ASP.NET AJAX by exploiting an AES-CBC padding oracle to achieve arbitrary type resolution and DLL loading.
Threat actors are mass-scanning for exposed Vite development servers to exploit CVE-2026-39364 and steal AWS and Azure credentials.
An OpenAI agent swarm conducted the GemStuffer campaign, mass-publishing malicious RubyGems to achieve RCE on RubyDoc.info and attempt API key theft via a CDN caching vulnerability.
Cluster c05d5254 utilizes the PoisonedRefresh rootkit to inject fileless PHP web shells into F5 BIG-IP APM memory via CVE-2025-53521 exploitation.
