Intel Exchange

Browse public community intelligence reports, source analysis, and threat research.

Cover image for VAPOR PANDA AI-Driven ARTEX Global Espionage Campaign

VAPOR PANDA AI-Driven ARTEX Global Espionage Campaign

VAPOR PANDA is using the ARTEX agentic AI framework and DeepSeek LLM to conduct simultaneous global espionage against foreign ministries and critical infrastructure sectors.

avatar
ills3c Intel&Coffee@Ills3C13 hours ago

4 intel reports

WSO2 API Manager JWT Bypass Exploitation

Threat actors are actively exploiting CVE-2026-5430 in WSO2 API Manager using forged JWT tokens with unsupported signing algorithms to gain administrative access.

avatar
Min Sakka@AlphaOmega
2 months ago
13
Breaking LiteLLM: Authentication Bypass and Root RCE

LiteLLM vulnerabilities (CVE-2026-59821, CVE-2026-59822) enable unauthenticated attackers to bypass security controls, achieve root-level RCE, and exfiltrate cloud IAM credentials.

avatar
Arnold Chan@slaz
2 months ago
8
CaptiveCrunch: Russian APTs Target Travelers via Wi-Fi Hijacking

Storm-2945, a sub-cluster of Midnight Blizzard (APT29), is hijacking hospitality Wi-Fi networks to deliver CornFlake RAT and ChocoShell infostealer via DNS poisoning and fake update prompts.

avatar
Ethan Andrews@eandrews
3 months ago
16
ADFS Golden SAML via Machine DPAPI Recovery

Mandiant researchers identified a method for attackers to recover active ADFS signing keys from Machine DPAPI when configuration drift occurs during manual certificate rotations, enabling Golden SAML token forgery.

avatar
Ethan Andrews@eandrews
4 months ago
15