Browse public community intelligence reports, source analysis, and threat research.
15 intel reports
UNC6692 uses email bombing and IT impersonation via Microsoft Teams to deploy the Edgecution/SNOW malware suite and facilitate ransomware access.
A state-sponsored threat group and Gunra ransomware actors exploited vulnerabilities in South Korean financial security software like AnySign4PC to deploy SIGNBT and COPPERHEDGE backdoors via watering holes.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
China-aligned actor SHADOW-EARTH-053 targets government and defense sectors in Asia using DLL sideloading, multiple tunneling tools, and exploitation of CVE-2025-55182.
The BlueHammer exploit chains NTFS junctions, batch oplocks, and the Cloud Files API to force Windows Defender into leaking SAM hive hashes, granting attackers SYSTEM-level access.
