Browse public community intelligence reports, source analysis, and threat research.
7 intel reports
Chinese-speaking actor leepsmarts executes the KeyHunter Operation, stealing 2,233 LLM API keys and orchestrating an academic fraud campaign targeting 20 universities.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
SkyW4lker is a device-code phishing kit targeting Microsoft 365 users, primarily in the US technology and manufacturing sectors, to bypass MFA and obtain access tokens.
The UNK_CondorFiltration campaign utilizes the TeamFiltration framework to compromise unmanaged Microsoft 365 service accounts in Chile through password spraying.
CISA red teams achieved full domain compromise and sensitive system access in two organizations, highlighting risks in cloud identity permissions and Active Directory Certificate Services (ADCS).
Lazarus group exploited a Windows AFD.sys zero-day (CVE-2026-68820) to deploy the FudModule rootkit against defense and aviation sectors via trojanized PDF software.
Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.
