Browse public community intelligence reports, source analysis, and threat research.
43 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
SafePay ransomware actors target global critical infrastructure by exploiting edge device vulnerabilities and using legitimate administrative tools for data exfiltration and hybrid encryption.
Ransomware actors Spikey Scorpius and Tarnished Scorpius are exploiting an authentication bypass in PAN-OS GlobalProtect (CVE-2026-0257) to gain initial access, bypass MFA, and pivot to virtualization infrastructure.
VulcanRAT207.B leverages RomulusLoader and signed VulkanInfo binaries to establish persistent remote access and kernel-level evasion on Windows systems.
Ransomware actors including Spikey Scorpius and Tarnished Scorpius are exploiting CVE-2026-0257 to bypass MFA and gain initial access to corporate networks via PAN-OS VPNs.
Akira ransomware affiliates utilize RDP for initial access, ProcDump for credential theft, and GOST tunnels for persistence before deploying Rclone for exfiltration and encrypting data.
ShinyHunters has evolved from a credential-theft crew into a resilient extortion brand and SaaS supply-chain threat, most recently exploiting PeopleSoft zero-days and third-party OAuth tokens.
Ransomware groups including CHAOS, Medusa, and Gunra are increasingly targeting radiology departments and healthcare providers using double-extortion and extortion-only tactics.
INC Ransomware threat actors utilize Bring Your Own Vulnerable Driver (BYOVD) tactics and dual ransom notes to pressure victims after exfiltrating data via tools like MEGASync.
