Browse public community intelligence reports, source analysis, and threat research.
3 intel reports
Russian FSB Center 16 and Static Tundra are actively exploiting the legacy Cisco Smart Install vulnerability (CVE-2018-0171) to extract device configurations and maintain persistence in critical infrastructure.
Russian-speaking threat actors are conducting a massive, automated credential-harvesting campaign named 'FortiBleed' targeting over 75,000 internet-facing Fortinet FortiGate firewalls and SSL VPNs across nearly 200 countries.
APT28 (Fancy Bear) exploited a chain of vulnerabilities in Windows LNK files to achieve remote code execution and zero-click NTLM authentication coercion.
