Browse public community intelligence reports, source analysis, and threat research.
39 intel reports
The TuxBot v3 Evolution framework is a modular IoT botnet targeting multiple architectures using LLM-assisted code generation and diverse C2 fallback mechanisms.
A threat actor compromised the jscrambler npm package, delivering cross-platform Rust-based infostealers through malicious preinstall hooks and self-executing functions targeting developers and CI/CD environments.
Threat actors are exploiting an unauthenticated remote code execution vulnerability in Langflow (CVE-2026-33017) to deploy a multi-stage Monero cryptomining toolchain and spread via SSH key reuse.
The MYRA Linux RAT, distributed via the npm package 'apintergrationpost', utilizes a native C rootkit and fileless execution for persistent system access.
A cryptocurrency-mining campaign exploits CVE-2026-33017, an unauthenticated RCE in Langflow, to deploy a Go-based miner with aggressive defense evasion and lateral movement capabilities.
The Chinese threat actor VerdantBamboo is targeting unmonitored edge appliances such as firewalls and NAS devices to maintain persistence and bypass EDR security controls.
Spanish and Portuguese speaking threat actors are utilizing agentic AI to automate full-chain intrusions against government and financial sectors in Latin America.
NVIDIA's NemoClaw sandbox environment is vulnerable to data exfiltration and configuration poisoning via weaponized authorized tools and emoji-based evasion.
A coordinated campaign of 36 malicious npm packages disguised as Strapi CMS plugins targets Guardarian cryptocurrency infrastructure to execute Redis RCE, steal database secrets, and establish persistent C2.
