Browse public community intelligence reports, source analysis, and threat research.
157 intel reports
The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.
An unknown APT group is using a complex .NET loading framework called NetamLoader to target customized Windows 10 builds used by Asian government entities via supply-chain infection vectors.
An extensive phishing campaign impersonating the U.S. District Court targets over 100,000 companies using personalized lures to deliver the LodaRAT remote access trojan via malicious ISO files.
The Yoba campaign utilizes SEO-poisoned GitHub repositories and fake AI desktop applications to distribute a custom loader that delivers XMRig miners via DLL sideloading.
Russian-speaking actors NyashTeam and Kapchenka operate Salat Stealer (WEB_RAT), a Go-based MaaS targeting Windows for credential and cryptocurrency theft.
Ransomware actors Spikey Scorpius and Tarnished Scorpius are exploiting an authentication bypass in PAN-OS GlobalProtect (CVE-2026-0257) to gain initial access, bypass MFA, and pivot to virtualization infrastructure.
Unauthorized AI relay services are reconfiguring legitimate OpenAI and Anthropic CLI tools to bypass regional restrictions, disabling sandboxes and routing data through third-party infrastructure.
Qilin and INC ransomware groups are exploiting CVE-2026-0257 in PAN-OS to bypass MFA and pivot into VMware virtualization environments for offline credential dumping.
China-linked APT41 (FishMonger) is using BlackX, a UEFI bootkit evolved from BlackLotus, to bypass Secure Boot and maintain persistence on diplomatic targets in Central Asia.
Ransomware actors including Spikey Scorpius and Tarnished Scorpius are exploiting CVE-2026-0257 to bypass MFA and gain initial access to corporate networks via PAN-OS VPNs.
