Browse public community intelligence reports, source analysis, and threat research.
44 intel reports
Luna Moth (Silent Ransom Group) uses voice-based callback phishing to trick victims into installing legitimate RMM tools for data extortion without using encryption.
ShinyHunters (UNC6240) is targeting healthcare through identity-access extortion using vishing/AitM kits and mass exploitation of CVE-2026-35273 in Oracle PeopleSoft.
A coordinated campaign of 16 malicious Firefox extensions masquerades as Rabby and OKX wallets to intercept and exfiltrate recovery phrases and private keys.
Akira ransomware affiliates utilize RDP for initial access, ProcDump for credential theft, and GOST tunnels for persistence before deploying Rclone for exfiltration and encrypting data.
Ransomware groups including CHAOS, Medusa, and Gunra are increasingly targeting radiology departments and healthcare providers using double-extortion and extortion-only tactics.
Unauthenticated attackers are exploiting CVE-2026-73570 in Zimbra Collaboration Suite to deploy JSP webshells, escalate privileges via PAM, and exfiltrate mailbox data.
An ongoing malicious npm campaign involving 'indexed-btree' and other packages bypasses lifecycle script defenses by burying loaders in runtime prototype methods and using Ethereum smart contracts for C2.
The Iranian Ministry of Intelligence and Security (MOIS) uses HEAVYGRAM (aka CHOSEN BRICK) malware to target dissidents and journalists via social engineering and Telegram-based command-and-control.
Iranian state cyber actors are using CHOSEN BRICK, a Windows-based spyware, to monitor dissidents and activists through social engineering and Telegram-based command and control.
Adversaries like SideCopy leverage tools such as Metasploit and Impacket to dump Active Directory's NTDS.dit and SYSTEM hives for full domain credential compromise.
