Browse public community intelligence reports, source analysis, and threat research.
107 intel reports
VAPOR PANDA is using the ARTEX agentic AI framework and DeepSeek LLM to conduct simultaneous global espionage against foreign ministries and critical infrastructure sectors.
China-state aligned actor Storm-0940 utilized the ARTEX agentic AI framework to automate a large-scale supply chain compromise targeting ConnectWise applications and downstream cloud environments.
Suspected UTA0576 exploited an Ivanti Connect Secure zero-day chain for root access and credential theft, documented via an exposed operator memory file.
VOLTA is a mature Windows infostealer that leverages LLMs to automate victim profiling and prioritize assets for monetization.
A 3AM ransomware affiliate targeted a UK school estate using a hybrid operation where a human operator guided an agentic AI loop to execute repetitive lateral movement and domain trust configuration tasks.
The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
Russian-speaking actors NyashTeam and Kapchenka operate Salat Stealer (WEB_RAT), a Go-based MaaS targeting Windows for credential and cryptocurrency theft.
The suspected PRC-nexus actor ARMORY CASTLE exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to deploy custom SAWFLY webshells and BARECLAW tunnelers for credential theft and lateral movement.
The bonto.io campaign uses malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys.
