Intel Exchange

Russian-speaking threat actors are conducting a massive, automated credential-harvesting campaign named 'FortiBleed' targeting over 75,000 internet-facing Fortinet FortiGate firewalls and SSL VPNs across nearly 200 countries.

The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.

The Colombian Smugglers group and other actors utilize techniques like Device Code Phishing and SVG smuggling to deliver malware including rmrlx, vjw0rm, and UnixStealer.

TeamPCP uses the Miasma worm to compromise developers and CI/CD pipelines by hijacking AI coding agents and poisoning package registries.

BQTLock ransomware utilizes a multi-stage PyInstaller-packed architecture, leveraging Remcos RAT for initial access and Discord/Telegram for covert command-and-control.

A highly sophisticated multi-stage npm supply chain campaign targeting Red Hat and AI-related packages uses GitHub as an adaptive C2 to deploy the Shai-Hulud infostealer variant 'Miasma'.

TeamPCP and other actors are leveraging container escapes via host vulnerabilities (CVE-2024-21626) and misconfigured orchestration APIs to compromise Kubernetes secrets and host systems.

Spanish and Portuguese speaking threat actors are utilizing agentic AI to automate full-chain intrusions against government and financial sectors in Latin America.

A Qilin ransomware affiliate is targeting WatchGuard and Fortinet appliances using multiple CVEs to deploy Sliver C2 and establish reverse SOCKS tunnels into internal networks.

Threat actor TeamPCP compromised the LiteLLM AI proxy via a cascading supply chain attack originating from malicious GitHub Actions in the Trivy vulnerability scanner.