Browse public community intelligence reports, source analysis, and threat research.
88 intel reports
Initial Access Broker Woodgnat (KongTuke) is deploying the Mistic and MLTBackdoor RATs via social engineering and compromised WordPress sites to sell network access to major ransomware affiliates.
A critical heap out-of-bounds write vulnerability in FFmpeg's MagicYUV decoder (CVE-2026-8461) allows remote code execution via crafted media files targeting media servers and thumbnail generators.
The Mastra AI framework suffered a supply chain attack involving over 140 compromised npm packages that deliver a cross-platform infostealer via a typosquatted dependency.
The GLASSWORM threat actor is deploying trojanized Open VSX extensions using TinyGo-compiled WebAssembly loaders that leverage Solana blockchain memos for C2 infrastructure resolution.
An attacker compromised the CDN API keys of OptinMonster, TrustPulse, and PushEngage to serve tampered JavaScript that creates rogue admin accounts on customer sites.
A chain of three vulnerabilities in the LiteLLM AI gateway allows low-privilege users to bypass authorization, escalate to administrative privileges, and execute arbitrary code on the host server.
Suspected Lazarus Group (DPRK) operators are using malicious VS Code extensions like jupyter-powerdev to deliver a multi-stage backdoor utilizing SharePoint for C2 and Roslyn for in-memory execution.
OceanLotus (APT32) is leveraging SPECTRALVIPER in targeted supply-chain attacks against Vietnamese stock investors and infrastructure corporations to support domestic surveillance.
TeamPCP uses the Miasma worm to compromise developers and CI/CD pipelines by hijacking AI coding agents and poisoning package registries.
A threat actor operating as Leda Elacoate is conducting a supply chain campaign using trojanized installers for crypto-trading and VPN software to deploy the STX RAT infostealer via DLL sideloading.
