Browse public community intelligence reports, source analysis, and threat research.
7 intel reports
Adversaries are deploying modular Linux implants including BPFDoor, Rekoobe, and the new AVERAT RAT against telecom edge appliances, utilizing SMTP-disguised C2 and BPF packet filtering to evade detection.
Anthropic identifies multi-vector misuse of Claude AI models by state-sponsored actors (Russia, China, Iran), financially motivated groups (ShinyHunters), and commercial entities for cyber operations, surveillance, and conventional weapons development.
Suspected state-sponsored actors and cybercriminals, including Midnight Blizzard and ShinyHunters, are utilizing generative AI frameworks like PentAGI to automate the cyber kill chain, reconnaissance, and malware development against global targets.
APT28 (Fancy Bear) is conducting a global campaign named FrostArmada, hijacking SOHO router DNS settings to facilitate adversary-in-the-middle attacks targeting Microsoft 365 credentials.
Russian intelligence services APT28 (GRU) and FSB Center 16 are systematically compromising SOHO and enterprise routers to build global proxy networks and conduct DNS hijacking for credential theft.
UAT-7810, a China-nexus infrastructure specialist, builds Operational Relay Box (ORB) networks targeting SOHO and enterprise systems using the LEASH malware family for secondary espionage actors.
The threat actor Storm-2372 is utilizing the EvilToken Phishing-as-a-Service (PhaaS) toolkit to execute automated, AI-enhanced device code phishing attacks against organizational accounts.
