Browse public community intelligence reports, source analysis, and threat research.
11 intel reports
Threat actors abuse Microsoft Teams external chat to pose as IT support, using email bombing and vishing to deploy remote access tools and malware.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
An unknown actor used a compromised ConnectWise Cloud Backup (SkyKick) application credential to sign in to customer Microsoft 365 tenants as the application itself, with Huntress reporting successful sign-ins in over 300 tenants.
ShinyHunters (UNC6240) is targeting healthcare through identity-access extortion using vishing/AitM kits and mass exploitation of CVE-2026-35273 in Oracle PeopleSoft.
DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.
ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.
Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.
The pro-Ukrainian threat actor Bearlyfy (Toy Ghouls) is targeting Russian organizations using their custom GenieLocker ransomware across Windows, Linux, and ESXi platforms.
BlueNoroff is utilizing an advanced phishing kit to impersonate Zoom and Microsoft Teams, profiling cryptocurrency wallets before delivering tailored malware to high-value targets.
Kimsuky targeted South Korean groupware vendors to compromise downstream customers using new Gomir malware variants and credential harvesting techniques.
