Browse public community intelligence reports, source analysis, and threat research.
106 intel reports
Adversaries compromised maintainer accounts and CI/CD pipelines to distribute trojanized PyPI and npm packages targeting quantum computing researchers and Alibaba developers.
North Korean threat actors compromised two @joyfill npm packages to deliver the DEV#POPPER RAT and OmniStealer via a multi-chain blockchain C2 infrastructure.
Adversaries including Phorpiex and Mozi increasingly utilize direct-to-IP (D2IP) communications to bypass DNS-based security controls and reach hard-coded C2 infrastructure.
The threat actor JINX-0163, operating as FulcrumSec, targets cloud-native environments using exposed credentials and RCE vulnerabilities to exfiltrate data for ransom.
BTMOB has evolved from a single Malware-as-a-Service operation into a fragmented ecosystem of independent resellers and source-code variants targeting Android users for financial theft.
A Chinese-speaking threat actor (Asia-Pacific Group) is utilizing leaked DarkSword exploit kit source code to target iOS 18.4-18.7 devices using GHOSTBLADE malware.
Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.
INC Ransomware and threat actor UTA0533 are weaponizing a zero-day exploit chain in SonicWall SMA 1000 series appliances to achieve root access and deploy memory-resident malware.
A new Windows infostealer called Dolphin X, sold by the actor Kontraktnik, uses AI-driven triage to prioritize high-value corporate and DevOps targets.
TAG-195 (Golden Chickens) has introduced a new generation of modular malware, including TinyEgg and ChonkyChicken, featuring enhanced browser credential theft and session automation via CDP.
