Intel Exchange

Chinese-speaking and English-speaking threat actors are using the Cairn AI penetration testing tool to automate vulnerability discovery and web shell deployment against global e-commerce and retail targets.

Threat actor TeamPCP executed a massive supply chain campaign compromising GitHub Actions from Aqua Security and Checkmarx, VS Code extensions, and npm packages to deploy a multi-stage credential stealer and a self-propagating worm.

The Cling botnet exploits multiple IoT vulnerabilities to deploy a worm-like malware that repurposes legitimate STUN traffic and infrastructure for command-and-control communications.

Russian-speaking threat actor Azazel, an affiliate of the Gentlemen ransomware group, utilizes stolen CI/CD secrets and novel MCP-based C2 channels to target global sectors and host stolen data on an independent leak site, LEAKNED.

The PoeLLM malware campaign targets exposed AI/LLM services like LiteLLM and Ollama for cryptomining and lateral scanning using a novel GitHub-based steganographic C2 mechanism.

IronChain is a destructive malware build packaged with PyInstaller that utilizes multiple kernel drivers for process termination and persistence while intentionally discarding encryption keys to prevent data recovery.

Longlegs (aka Storm-2603), a China-nexus threat actor, is deploying Warlock ransomware against critical infrastructure and government sectors by exploiting SharePoint 'ToolShell' vulnerabilities.

An operator identified as Zaib Ali uses a massive npm typosquatting campaign to discover infrastructure and a custom FastAPI framework called VHX Harvester to hijack GPU resources on the vast.ai marketplace.

The CARBONATO botnet exploits unauthenticated Docker daemons to deploy an AI-driven Hermes Agent for automated post-exploitation and credential harvesting via Telegram.

An unidentified operator using Simplified Chinese tools conducted iOS exploitation via the Coruna kit, multi-vector web attacks, and an AI-assisted gambling SEO campaign.