Browse public community intelligence reports, source analysis, and threat research.
3 intel reports
ESET researchers discovered 11 Microsoft-signed UEFI shim bootloaders that allow attackers to bypass Secure Boot and deploy bootkits like BlackLotus and Bootkitty.
Russian FSB Center 16 and Static Tundra are actively exploiting the legacy Cisco Smart Install vulnerability (CVE-2018-0171) to extract device configurations and maintain persistence in critical infrastructure.
The GreatXML exploit by researcher Nightmare-Eclipse abuses the Windows Recovery Environment and Defender Offline Scan state to bypass BitLocker encryption using a malicious unattend.xml file.
