Browse public community intelligence reports, source analysis, and threat research.
4 intel reports
Play (or Playcrypt) is a sophisticated ransomware group utilizing double extortion, custom information stealers like Grixba, and exploitation of vulnerabilities in FortiOS and Microsoft Exchange to target global organizations.
An authorized attacker can exploit CVE-2026-45504, a high-severity SSRF in Microsoft Exchange Server, to perform local file reads by manipulating EWS reference attachments and WOPI-related preview logic.
StrikeShark leverages custom SharkLoader malware via DLL sideloading and public-facing application exploits to deploy Cobalt Strike Beacons across diverse global sectors.
SystemBC is a Windows-based malware family used as a SOCKS5 proxy and persistent RAT by major ransomware groups to tunnel malicious traffic and execute payloads.
