Browse public community intelligence reports, source analysis, and threat research.
6 intel reports
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
Suspected Silver Fox actors are targeting Latin American banking and financial sectors using fake DocuSign and NFe tax lures to deliver a custom HVNC backdoor for persistent remote control.
Threat actors are abusing the legitimate Faronics Deploy platform to execute malicious PowerShell scripts and establish persistent remote access via ScreenConnect.
The RMRLX malware family uses a multi-stage JavaScript and PowerShell loader to deploy LxBaseRAT, a sophisticated .NET tool targeting browser credentials, cryptocurrency wallets, and Discord tokens.
A pre-authentication memory overread vulnerability (CVE-2026-8451) in Citrix NetScaler appliances configured as SAML IdPs allows for information leakage and denial of service.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
