Browse public community intelligence reports, source analysis, and threat research.
34 intel reports
A suspected Russian-speaking actor used an AI-assisted toolkit (PentAGI) to exploit PaperCut vulnerabilities (CVE-2026-81578, CVE-2026-82078) and maintain persistence access across 45+ countries.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
The Gheist campaign utilizes stolen GitHub tokens to plant malicious workflows that exfiltrate secrets via base32-encoded logs, circumventing traditional security masks.
The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).
Play (or Playcrypt) is a sophisticated ransomware group utilizing double extortion, custom information stealers like Grixba, and exploitation of vulnerabilities in FortiOS and Microsoft Exchange to target global organizations.
Attackers can leverage leaked GitLab incoming email tokens to push code, execute CI/CD jobs, and bypass IP restrictions by spoofing merge request emails.
An unidentified attacker compromised 3BB's network in Thailand, deploying MeshCentral for persistence and targeting subscriber RADIUS databases after attempting to exploit FortiGate SSL-VPN vulnerabilities.
A threat actor designated TH-3BB targeted Thai ISP 3BB and Jasmine International using CVE-2024-21762 for initial access and MeshCentral for persistent command-and-control.
Russia-aligned threat actor UAC-0099 is using the GuardBreaker technique to trip AI safety guardrails and blind automated malware analysis tools targeting Ukrainian critical infrastructure.
CISA red teams achieved full domain compromise and sensitive system access in two organizations, highlighting risks in cloud identity permissions and Active Directory Certificate Services (ADCS).
