Browse public community intelligence reports, source analysis, and threat research.
5 intel reports
IronChain is a destructive malware build packaged with PyInstaller that utilizes multiple kernel drivers for process termination and persistence while intentionally discarding encryption keys to prevent data recovery.
A vulnerability in Cloudflare Containers allowed cross-tenant data exposure by recovering residual disk blocks from physical storage pools due to disabled block zeroing in Linux dm-thin provisioning. Note: No customer action required. This has been remediated by Cloudflare.
Threat actors can leverage WSL2's virtualized environment to download and stage payloads on Windows while remaining invisible to host-based network and process-attribution telemetry.
A coordinated campaign of 36 malicious npm packages disguised as Strapi CMS plugins targets Guardarian cryptocurrency infrastructure to execute Redis RCE, steal database secrets, and establish persistent C2.
A Chinese-speaking threat actor uses VoidLink, a modular AI-assisted framework, to deploy hybrid LKM/eBPF rootkits for kernel-level stealth and ICMP-based C2 on Linux systems.
