Browse public community intelligence reports, source analysis, and threat research.
28 intel reports
The Ebury botnet hijacked 377 Tor exit relays to intercept SSH connections, steal passwords, and redirect encrypted mail traffic to plaintext ports.
Adversaries utilize eBPF rootkits like Bad-bpf to evade traditional Linux integrity monitoring by intercepting syscalls and rewriting user-space memory without modifying kernel symbols.
A vulnerability chain in OnePlus OxygenOS allows a no-permission malicious app to achieve full root access by exploiting AtlasService and a vendor-specific olc2 HAL.
The Rapuncel infostealer is distributed via SEO-optimized fake GitHub organizations, utilizing a Microsoft-signed kernel driver to disable security software.
The Gentlemen threat actor group is utilizing the cross-platform TukTuk C2 framework and BYOVD techniques to neutralize EDR solutions while targeting global technology and healthcare sectors.
AvisLoader is a Windows loader using the Tox encrypted peer-to-peer messaging network for command-and-control to evade traditional domain-based takedowns.
Suspected Chinese threat actor Red Heron is exploiting CVE-2026-60004 in Gitea to deploy the JITTERLY implant and SIXZUT rootkit for source code theft and lateral movement.
REVSTEALER is a comprehensive Windows infostealer using Polygon smart contracts for resilient C2 infrastructure and delivering specialized modules for crypto-mining and reverse proxying.
The Kim Sooki threat actor utilizes the Syslogk Linux rootkit to achieve persistence and concealment by hooking kernel APIs to hide processes, network connections, and files.
China-nexus actor Fire Ant is compromising Cisco Nexus switches and IOS XR routers to harvest credentials and establish covert tunnels into critical infrastructure.
