Browse public community intelligence reports, source analysis, and threat research.
71 intel reports
The pro-Ukrainian threat actor Bearlyfy (Toy Ghouls) is targeting Russian organizations using their custom GenieLocker ransomware across Windows, Linux, and ESXi platforms.
Researchers identified 84 'iTrue' vulnerabilities in cellular core networks arising from implicit trust between components, enabling denial-of-service and session hijacking across major open-source and commercial implementations.
Chinese-speaking threat actors are using OctLurk and SilkLurk backdoors to target government, healthcare, and educational sectors in Central Asia via modular in-memory plugins.
The TAG-195 threat group is using the ChonkyChicken RAT and ChromEggscalator helper to bypass Chrome App-Bound encryption and hijack authenticated browser sessions via the ClickFix social engineering technique.
Suspected Chinese-speaking threat actors target Central Asian government sectors using two new obfuscated backdoors, OctLurk and SilkLurk, for data theft and persistent access.
TAG-195 (Golden Chickens) has introduced a new generation of modular malware, including TinyEgg and ChonkyChicken, featuring enhanced browser credential theft and session automation via CDP.
The JadePuffer campaign utilized an autonomous LLM-driven agent to exploit a Langflow vulnerability, pivot to production databases, and execute a self-correcting ransomware operation.
NadMesh is an autonomous, Go-based botnet designed to harvest AI service credentials and exploit infrastructure including Docker, Kubernetes, and Model Context Protocol (MCP) services.
The TuxBot v3 Evolution framework is a modular IoT botnet targeting multiple architectures using LLM-assisted code generation and diverse C2 fallback mechanisms.
Russian FSB Center 16 and Static Tundra are actively exploiting the legacy Cisco Smart Install vulnerability (CVE-2018-0171) to extract device configurations and maintain persistence in critical infrastructure.
