Browse public community intelligence reports, source analysis, and threat research.
6 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
Lazarus group exploited a Windows AFD.sys zero-day (CVE-2026-68820) to deploy the FudModule rootkit against defense and aviation sectors via trojanized PDF software.
Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.
Russia-aligned threat group UAC-0099 is delivering a multi-stage infection chain involving LUNCHPOKE, BURNYBEAR, and MATCHBOIL.V2 by abusing legitimate Notepad++ plugin loading routines.
The Russia-aligned actor TA458 uses half-click XSS zero-day exploits against SOGo, Zimbra, and Roundcube webmail to deploy SpyPress malware and steal sensitive government data.
The China-aligned threat actor UNK_MassTraction is exploiting Roundcube vulnerabilities to deploy IceCube and VShell backdoors against US and Canadian university physics departments.
