Browse public community intelligence reports, source analysis, and threat research.
12 intel reports
A Russian-speaking threat actor uses XaocMail phishing and ClickFix lures to deploy the Phantom53 DoH framework and Havoc post-exploitation agents.
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
A vulnerability chain in OnePlus OxygenOS allows a no-permission malicious app to achieve full root access by exploiting AtlasService and a vendor-specific olc2 HAL.
China-aligned actor FamousSparrow is targeting Latin American governments with SparroWocky, a sophisticated C++ backdoor featuring advanced anti-analysis and modular execution capabilities.
Gamaredon, a Russian FSB-operated group, uses a multi-stage modular framework (GammaPhish, GammaLoad, GammaWorm, GammaSteel) to maintain persistent access and exfiltrate sensitive documents from Ukrainian government and critical infrastructure.
The Superior threat actor uses 19 malicious Chrome and Edge extensions to deliver wallet drainers and credential-stealing payloads through a modular JavaScript framework.
UNC6692 uses email bombing and IT impersonation via Microsoft Teams to deploy the Edgecution/SNOW malware suite and facilitate ransomware access.
Anonymous researcher 'bikini' released Exploitarium, a repository containing over 30 proof-of-concept exploits for unpatched vulnerabilities across multiple software projects, including critical flaws in libssh2 and Gitea.
The threat actor Nightmare Eclipse released the RoguePlanet zero-day exploit (CVE-2026-50656) targeting a race condition in Microsoft Defender to achieve SYSTEM privileges on Windows 10 and 11.
The emiltype actor published a malicious npm package nodemon-sudo that uses the dependency tslint-conf to fetch and execute a second-stage payload via IPFS at runtime.
