Browse public community intelligence reports, source analysis, and threat research.
100 intel reports
A suspected Russian-speaking actor used an AI-assisted toolkit (PentAGI) to exploit PaperCut vulnerabilities (CVE-2026-81578, CVE-2026-82078) and maintain persistence access across 45+ countries.
A suspected China-nexus actor utilized an AI-assisted custom PHP2Shell exploit chain and Fragnesia kernel LPE to root 25 servers, including U.S. government-affiliated systems.
A trojanized version (2.1.313) of the Anthropic Claude Code VS Code extension plants a persistent SSH reverse tunnel and performs host reconnaissance.
The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
Mustang Panda is targeting Southeast Asian diplomatic entities using new in-memory ZOHOMURK SOCKS5 tunnelers and MINIRECON automated reconnaissance tools deployed via DLL side-loading.
An extensive phishing campaign impersonating the U.S. District Court targets over 100,000 companies using personalized lures to deliver the LodaRAT remote access trojan via malicious ISO files.
C2Agent is a sophisticated Go-based Windows malware that utilizes Large Language Models (LLMs) and the Model Context Protocol (MCP) to interactively drive post-exploitation activities.
The suspected PRC-nexus actor ARMORY CASTLE exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to deploy custom SAWFLY webshells and BARECLAW tunnelers for credential theft and lateral movement.
