Browse public community intelligence reports, source analysis, and threat research.
9 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
Adversaries like SideCopy leverage tools such as Metasploit and Impacket to dump Active Directory's NTDS.dit and SYSTEM hives for full domain credential compromise.
Russian enterprises are facing sophisticated multi-stage attacks from NightEagle, Hacking Cat, and Toy Ghouls involving custom backdoors, wipers, and tunneling tools.
CISA red teams achieved full domain compromise and sensitive system access in two organizations, highlighting risks in cloud identity permissions and Active Directory Certificate Services (ADCS).
Certighost (CVE-2026-54121) is a critical improper authorization vulnerability in AD CS allowing low-privileged users to impersonate Domain Controllers by abusing unverified directory referrals.
The pro-Ukrainian threat actor Bearlyfy (Toy Ghouls) is targeting Russian organizations using their custom GenieLocker ransomware across Windows, Linux, and ESXi platforms.
A new Windows infostealer called Dolphin X, sold by the actor Kontraktnik, uses AI-driven triage to prioritize high-value corporate and DevOps targets.
The JadePuffer campaign utilized an autonomous LLM-driven agent to exploit a Langflow vulnerability, pivot to production databases, and execute a self-correcting ransomware operation.
dMSA Ouroboros is a persistence technique in Windows Server 2025 that uses self-referencing GroupMSAMembership and Shadow Credentials to automate the extraction of NT hashes from superseded accounts.
