Browse public community intelligence reports, source analysis, and threat research.
44 intel reports
UNC3753 (Silent Ransom Group) targets US legal and financial services using vishing to deploy RMM tools and, in some cases, physical office intrusions to exfiltrate data via USB.
Russia-aligned threat actor Gorbag targets Ukrainian government and defense sectors using the CVE-2025-8088 WinRAR vulnerability to deploy BeautyStealer and GIFTEDCROOK malware.
The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
The threat actor k0t (aka CryptoFeel) is mass-exploiting edge appliances via CVE-2025-64446 and CVE-2026-0257 to steal credentials and facilitate ransomware attacks.
A Chinese-speaking threat actor utilizes the ARTEX framework combined with multiple AI models to automate global reconnaissance and data exfiltration targeting PII and financial records.
Storm-3119 (YAM Store) acts as a power broker selling compromised Microsoft 365 and Google infrastructure to Storm-2990, who develops and operates global Phishing-as-a-Service (PaaS) kits.
Gryxa is a highly persistent, AI-developed toolkit used by financially motivated actors to steal credentials and maintain durable access via extensive recovery mechanisms.
Silent Ransom Group (Luna Moth) is conducting high-value data extortion campaigns against US law firms using a combination of vishing and physical office intrusions to exfiltrate sensitive data.
Akira ransomware targets global organizations across Windows and Linux platforms using double extortion, vulnerability exploitation, and credential theft.
