Browse public community intelligence reports, source analysis, and threat research.
27 intel reports
A suspected Russian-speaking actor used an AI-assisted toolkit (PentAGI) to exploit PaperCut vulnerabilities (CVE-2026-81578, CVE-2026-82078) and maintain persistence access across 45+ countries.
Akira ransomware targets global organizations across Windows and Linux platforms using double extortion, vulnerability exploitation, and credential theft.
The Cl0p extortion operation has pivoted from traditional encryption-based ransomware to large-scale data theft via the exploitation of internet-facing Managed File Transfer (MFT) and enterprise software.
The STAC4924 campaign, linked to GOLD VICTOR (Vice Society), uses TerminalFix lures to deploy Lorem Ipsum Loader and custom Python tunneling implants via DLL sideloading.
An operator identified as Zaib Ali uses a massive npm typosquatting campaign to discover infrastructure and a custom FastAPI framework called VHX Harvester to hijack GPU resources on the vast.ai marketplace.
Everest is a sophisticated .NET-based ransomware that employs aggressive lateral movement, service termination, and process self-protection while targeting Windows environments.
INC Ransomware threat actors utilize Bring Your Own Vulnerable Driver (BYOVD) tactics and dual ransom notes to pressure victims after exfiltrating data via tools like MEGASync.
State-sponsored and criminal actors are increasingly using AI as an engineering workforce to automate exploit development, surveillance, and multi-victim cyber campaigns.
DragonForce is a ransomware service ecosystem deploying Windows lockers that use ChaCha8 encryption and target SMB shares to maximize network impact.
BlackSuit ransomware operators conducted a 9-day intrusion starting with VPN brute-force attacks on non-MFA accounts, followed by lateral movement via RDP and data staging before enterprise-wide encryption.
