Browse public community intelligence reports, source analysis, and threat research.
13 intel reports
ShinyHunters (UNC6240) is targeting healthcare through identity-access extortion using vishing/AitM kits and mass exploitation of CVE-2026-35273 in Oracle PeopleSoft.
ShinyHunters has evolved from a credential-theft crew into a resilient extortion brand and SaaS supply-chain threat, most recently exploiting PeopleSoft zero-days and third-party OAuth tokens.
UNC6240 (ShinyHunters) is conducting mass exploitation of CVE-2026-35273 in Oracle PeopleSoft using WAF bypass techniques to deploy SIDEEYE backdoors and MeshCentral agents for extortion.
Russian-speaking threat actors are exploiting a heap-based buffer overflow (CVE-2025-25249) in FortiGate devices to deploy PivotC2, an AI-assisted Node.js RAT for network tunneling and credential theft.
UNC6240 (ShinyHunters) exploited an unauthenticated RCE chain in Oracle PeopleSoft (CVE-2026-35273) to target higher education and steal sensitive data.
The JadePuffer campaign utilized an autonomous LLM-driven agent to exploit a Langflow vulnerability, pivot to production databases, and execute a self-correcting ransomware operation.
Threat actors are chaining critical vulnerabilities CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 appliances to gain root access and pivot into internal corporate networks.
Russian FSB Center 16 (Static Tundra) targets critical infrastructure by exploiting weak SNMP configurations and legacy Cisco vulnerabilities to exfiltrate device configurations.
Everest is a Russian-speaking ransomware group utilizing a triple-stream business model including file encryption, initial access brokerage, and paid corporate insider recruitment.
Turla (Secret Blizzard) targets government and military entities globally using the custom STOCKSTAY and Kazuar backdoors, often leveraging hijacked infrastructure.
