Browse public community intelligence reports, source analysis, and threat research.
52 intel reports
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
Dropping Elephant is using a China-themed decoy document to deliver a heavily reworked, in-memory RAT via DLL side-loading and Donut shellcode.
The MovieBox Android malware masquerades as a premium streaming service to perform advanced reconnaissance, data exfiltration, and UI overlay attacks.
UNC6240 (ShinyHunters) exploited CVE-2026-35273 as a zero-day to target Oracle PeopleSoft infrastructure, primarily in the higher education sector, for data exfiltration and extortion.
Phantom Stealer utilizes obfuscated VBScript droppers and .NET loaders with Telegram-based C2 infrastructure to exfiltrate browser credentials and system data.
BQTLock ransomware utilizes a multi-stage PyInstaller-packed architecture, leveraging Remcos RAT for initial access and Discord/Telegram for covert command-and-control.
Hannibal Stealer is a sophisticated .NET-based information harvester and cryptocurrency stealer that utilizes DLL injection, Telegram-based C2, and clipboard hijacking to target browser data, VPN configurations, and crypto wallets.
The threat actor STAC6405 is conducting an ongoing phishing campaign targeting U.S. organizations with a dual-RMM architecture using SimpleHelp and ScreenConnect for persistent, silent access.
A Qilin ransomware affiliate is targeting WatchGuard and Fortinet appliances using multiple CVEs to deploy Sliver C2 and establish reverse SOCKS tunnels into internal networks.
A coordinated campaign of 36 malicious npm packages disguised as Strapi CMS plugins targets Guardarian cryptocurrency infrastructure to execute Redis RCE, steal database secrets, and establish persistent C2.
