Browse public community intelligence reports, source analysis, and threat research.
3 intel reports
Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.
Russia-aligned threat group UAC-0099 is delivering a multi-stage infection chain involving LUNCHPOKE, BURNYBEAR, and MATCHBOIL.V2 by abusing legitimate Notepad++ plugin loading routines.
Russian-affiliated threat actor CL-STA-1114 exploits a zero-click vulnerability in Zimbra Collaboration Suite to exfiltrate user credentials and email archives from global targets.
