Browse public community intelligence reports, source analysis, and threat research.
98 intel reports
The NightEagle APT group (APT-Q-95) is targeting Russian businesses by deploying the GhostContainer backdoor on Microsoft Exchange servers and utilizing legitimate tunneling tools for lateral movement.
Unidentified threat actors are exploiting multiple authentication bypass and remote code execution vulnerabilities in N-able N-central to compromise managed service providers and their downstream customers.
An unattributed threat actor launched a mass ACH fraud campaign using AI-assisted templates to impersonate executives and vendors, targeting accounts payable departments with highly personalized lures.
An unsigned GlobalProtect-themed MSI deploys a backdoor that utilizes Cloudflare Workers for configuration and Google Sheets for C2 communication, specifically targeting victims in Myanmar.
RedTail is a multi-architecture Linux malware that utilizes process masquerading, DNS-over-TLS for C2, and aggressive termination of analysis tools to maintain persistence and evade detection.
A Chinese-speaking operator uses the PEEP toolkit, a RedExt derivative, to transform Chromium browsers into persistent host-level backdoors via native-messaging bridges.
Suspected Silver Fox (Yinhu) threat actors are targeting Chinese-speaking users and multinational operations in China using high-fidelity spoofed vendor sites to deliver persistent implants like ValleyRAT.
StyleSmuggler is an unauthenticated remote code execution vulnerability (CVE-2026-75650) in Adobe Commerce and Magento exploited to deploy persistent implants and web shells.
China-nexus actor Fire Ant is compromising Cisco Nexus switches and IOS XR routers to harvest credentials and establish covert tunnels into critical infrastructure.
The NinjaMare campaign uses typosquatted domains and MSIX installers to deliver a remote-controlled input injection engine disguised as a privacy browser.
