Browse public community intelligence reports, source analysis, and threat research.
16 intel reports
Cloud Atlas APT targets government and diplomatic entities in Russia and Belarus using a revamped toolset including VBCloud, PowerShower, and the new PowerCloud data exfiltration script.
The KongTuke group is leveraging Microsoft Teams social engineering to deploy ModeloRAT, escalate privileges via CVE-2023-36036, and harvest domain credentials using fake Windows lock screens.
Spanish and Portuguese speaking threat actors are utilizing agentic AI to automate full-chain intrusions against government and financial sectors in Latin America.
UNC5142 utilizes EtherRAT and the AI-generated TukTuk framework to conduct data exfiltration and deploy The Gentlemen ransomware via decentralized and SaaS infrastructure.
An Iranian-nexus threat actor targeted 12 Omani government ministries using a custom C2 framework, ProxyShell exploits, and DotNetNuke vulnerabilities to exfiltrate judicial and citizen data.
Microsoft Defender blocked a large-scale human-operated ransomware attack that attempted to weaponize Group Policy Objects (GPOs) for security tampering and automated payload distribution.
