Browse public community intelligence reports, source analysis, and threat research.
12 intel reports
Threat actors are utilizing AI-assisted reverse engineering of Android and Flutter applications to discover and exploit vulnerabilities in backend APIs, bypassing front-end controls.
The cyber criminal group TeamPCP is conducting large-scale software supply chain attacks targeting DevOps and security tools to exfiltrate cloud credentials and secrets.
The threat actor JINX-0163, operating as FulcrumSec, targets cloud-native environments using exposed credentials and RCE vulnerabilities to exfiltrate data for ransom.
The ChocoPoC threat actor is targeting security researchers with trojanized GitHub PoC repositories that install malicious PyPI packages to deliver a Python-based RAT.
StrikeShark leverages custom SharkLoader malware via DLL sideloading and public-facing application exploits to deploy Cobalt Strike Beacons across diverse global sectors.
A highly sophisticated multi-stage npm supply chain campaign targeting Red Hat and AI-related packages uses GitHub as an adaptive C2 to deploy the Shai-Hulud infostealer variant 'Miasma'.
UNC5142 utilizes EtherRAT and the AI-generated TukTuk framework to conduct data exfiltration and deploy The Gentlemen ransomware via decentralized and SaaS infrastructure.
China-nexus threat group UAT-8302 targets government entities in South America and southeastern Europe using a suite of shared and custom malware including NetDraft, CloudSorcerer, and VSHELL.
China-aligned actor SHADOW-EARTH-053 targets government and defense sectors in Asia using DLL sideloading, multiple tunneling tools, and exploitation of CVE-2025-55182.
Threat actor Dr. Tube uses the Bissa Scanner and AI tools like Claude Code to exploit React2Shell vulnerabilities at scale, targeting financial and crypto sectors for secret harvesting.
