Browse public community intelligence reports, source analysis, and threat research.
32 intel reports
BlackSuit ransomware operators conducted a 9-day intrusion starting with VPN brute-force attacks on non-MFA accounts, followed by lateral movement via RDP and data staging before enterprise-wide encryption.
A suspected Chinese-speaking operator utilized the SecFlow AI orchestration framework to exploit multiple vulnerabilities and deploy steganographic GLUTTON webshells against government and education targets across Asia.
OnyxC2 is a sophisticated Malware-as-a-Service info-stealer and remote access toolkit targeting over 200 applications including crypto wallets, browsers, and 2FA extensions.
The Head Mare APT group is exploiting TrueConf Server vulnerabilities to distribute PhantomCore and PhantomGraph backdoors via infected client installers.
Head Mare APT exploits a chain of vulnerabilities in TrueConf Server to distribute PhantomCore and PhantomGraph backdoors via Trojanized client installers.
UNC6692 uses email bombing and IT impersonation via Microsoft Teams to deploy the Edgecution/SNOW malware suite and facilitate ransomware access.
Adversaries can bypass passwordless protections by exploiting Google’s Cloud Authenticator onboarding and recovery flows to extract master keys or forge authentication signatures.
The Qilin (aka Agenda) ransomware group is exploiting a critical Palo Alto Networks authentication bypass vulnerability (CVE-2026-0257) to gain initial access and deploy ransomware via credential-driven lateral movement.
An unknown threat actor deployed a new Rust-based ransomware called Spirals against a South Asian IT services company using web shell access and rapid lateral movement.
The GoSerpent campaign utilizes a sophisticated suite of Go-based backdoors and specialized loaders to collect and exfiltrate sensitive data from government and diplomatic entities in Southeast Asia.
