Browse public community intelligence reports, source analysis, and threat research.
39 intel reports
A suspected Russian-speaking actor used an AI-assisted toolkit (PentAGI) to exploit PaperCut vulnerabilities (CVE-2026-81578, CVE-2026-82078) and maintain persistence access across 45+ countries.
Adversaries are actively exploiting multiple zero-day vulnerabilities in Citrix NetScaler ADC and Gateway to deploy persistence mechanisms including PHP-based webshells and remote management tools.
A China-linked operator utilized the AI-driven Cairn framework to conduct 66 intrusions against government and industry targets across Asia, leveraging LLM agents for automated exploitation.
Unknown attackers compromised the Rank Math PRO WordPress plugin version 3.0.123 to deploy self-rebuilding backdoors and unauthorized administrator accounts.
Threat actors are exploiting a remote code execution vulnerability in REDCap servers (CVE-2026-90817) to deploy XMRig miners using fileless techniques and steganography.
Unauthenticated attackers are exploiting CVE-2026-104286, a critical path traversal vulnerability in FortiMail, to write arbitrary files and achieve persistent remote code execution.
The CARBONATO botnet exploits unauthenticated Docker daemons to deploy an AI-driven Hermes Agent for automated post-exploitation and credential harvesting via Telegram.
The SC WordPress malware utilizes a redundant eight-component mesh across files, databases, and shared memory to self-heal and communicate via Ethereum blockchain gateways.
Unauthenticated attackers are exploiting CVE-2026-73570 in Zimbra Collaboration Suite to deploy JSP webshells, escalate privileges via PAM, and exfiltrate mailbox data.
A financially motivated operator using the persona 'SOUL - Red Team Operator' employs autonomous AI harnesses (Hermes, Strix, Cairn) to breach online retailers, steal credit card data, and inject skimmer scripts.
