Browse public community intelligence reports, source analysis, and threat research.
16 intel reports
Attackers give the open source ARTEX framework credentials and a goal. Its AI agents then run Active Directory enumeration, Kerberoasting, DCSync and cloud probing. Google tracks the activity as UNC7228, which overlaps Storm-0940.
BlackSuit ransomware operators conducted a 15-day intrusion involving Kerberoasting, lateral movement via SMB and RDP, and persistence through SystemBC before final encryption.
Comprehensive analysis of Active Directory exploitation techniques including NTLM relaying, Kerberos delegation abuse, and AD Certificate Services vulnerabilities.
SafePay ransomware actors target global critical infrastructure by exploiting edge device vulnerabilities and using legitimate administrative tools for data exfiltration and hybrid encryption.
ShinyHunters has evolved from a credential-theft crew into a resilient extortion brand and SaaS supply-chain threat, most recently exploiting PeopleSoft zero-days and third-party OAuth tokens.
An unidentified operator using Simplified Chinese tools conducted iOS exploitation via the Coruna kit, multi-vector web attacks, and an AI-assisted gambling SEO campaign.
Adversaries like SideCopy leverage tools such as Metasploit and Impacket to dump Active Directory's NTDS.dit and SYSTEM hives for full domain credential compromise.
BlackSuit ransomware operators conducted a 9-day intrusion starting with VPN brute-force attacks on non-MFA accounts, followed by lateral movement via RDP and data staging before enterprise-wide encryption.
Gunra is a sophisticated RaaS variant derived from Conti source code that utilizes Fortinet exploits and multi-threaded encryption to target global critical infrastructure.
Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.
