Browse public community intelligence reports, source analysis, and threat research.
8 intel reports
Purple Ghosts compromised over 14,000 Dahua cameras globally using an authentication-bypass chain and P2P relay exploitation to install persistent backdoors and harvest credentials.
Suspected Chinese threat actor Red Heron is exploiting CVE-2026-60004 in Gitea to deploy the JITTERLY implant and SIXZUT rootkit for source code theft and lateral movement.
A Russian-speaking operator compromised over 14,000 Dahua IP cameras globally, primarily in Ukraine and Russia, using authentication bypasses, P2P relay abuse, and credential brute-forcing.
Russian intelligence services APT28 (GRU) and FSB Center 16 are systematically compromising SOHO and enterprise routers to build global proxy networks and conduct DNS hijacking for credential theft.
NadMesh is an autonomous, Go-based botnet designed to harvest AI service credentials and exploit infrastructure including Docker, Kubernetes, and Model Context Protocol (MCP) services.
Russian FSB Center 16 (Static Tundra) targets critical infrastructure by exploiting weak SNMP configurations and legacy Cisco vulnerabilities to exfiltrate device configurations.
Russian-speaking threat actors are conducting a massive, automated credential-harvesting campaign named 'FortiBleed' targeting over 75,000 internet-facing Fortinet FortiGate firewalls and SSL VPNs across nearly 200 countries.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
