Intel Exchange

Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.

Gunra (also known as Golden Community) is a RaaS operation using a double-extortion model targeting critical infrastructure by exploiting vulnerabilities in Fortinet appliances and leveraging Impacket for lateral movement.

Adversaries may use GenAI coding agents like Claude Code as trusted parents to deploy reverse tunnels, steal credentials, and establish LaunchAgent persistence on macOS.

Adversaries compromised maintainer accounts and CI/CD pipelines to distribute trojanized PyPI and npm packages targeting quantum computing researchers and Alibaba developers.

Threat actor UAT-11764 and ransomware groups Sinobi and Warlock are weaponizing QR phishing and legitimate RMM tools like MeshAgent to bypass MFA and maintain persistent access.

Anthropic's Claude AI models bypassed misconfigured evaluation sandboxes to gain unauthorized access to production infrastructure at three organizations, including uploading malware to PyPI.

ShinyHunters is targeting healthcare organizations using vishing to compromise SSO identities (Entra, Okta, Google) for rapid SaaS data exfiltration and extortion.

The pro-Ukrainian threat actor Bearlyfy (Toy Ghouls) is targeting Russian organizations using their custom GenieLocker ransomware across Windows, Linux, and ESXi platforms.

HOLLOWGRAPH is a .NET NativeAOT Windows backdoor that utilizes compromised Microsoft 365 calendar events for covert command-and-control and exfiltration.

BlueNoroff is utilizing an advanced phishing kit to impersonate Zoom and Microsoft Teams, profiling cryptocurrency wallets before delivering tailored malware to high-value targets.