Browse public community intelligence reports, source analysis, and threat research.
3 intel reports
Russian-speaking threat actors are exploiting CVE-2026-35616 in FortiClient EMS to deploy EKZ Stealer and FortigateSniffer, facilitating credential harvesting and subsequent ransomware attacks by INC Ransom and Lynx.
The Gentlemen Ransomware-as-a-Service (RaaS) group utilizes a sophisticated EDR-killing framework and targets global organizations using leaked Fortinet VPN credentials.
An ongoing campaign, dubbed ForceMemo, compromises developer GitHub accounts to inject malware into Python repositories using a stealthy force-push technique and a Solana-based C2.
