Browse public community intelligence reports, source analysis, and threat research.
142 intel reports
Unidentified threat actors are exploiting multiple authentication bypass and remote code execution vulnerabilities in N-able N-central to compromise managed service providers and their downstream customers.
The Vectra (formerly Nyxel) actor operates VectraRAT, a custom Go and C++ Malware-as-a-Service platform delivered via Amadey and ClickFix campaigns targeting corporate Windows environments.
RedTail is a multi-architecture Linux malware that utilizes process masquerading, DNS-over-TLS for C2, and aggressive termination of analysis tools to maintain persistence and evade detection.
A Chinese-speaking operator uses the PEEP toolkit, a RedExt derivative, to transform Chromium browsers into persistent host-level backdoors via native-messaging bridges.
Kimsuky leverages AI agents like opencode and HeadlessChrome to mass-produce decoy documents while evolving its GitHub-based LNK execution framework with enhanced evasion and persistence.
Russian-speaking threat actors are exploiting a heap-based buffer overflow (CVE-2025-25249) in FortiGate devices to deploy PivotC2, an AI-assisted Node.js RAT for network tunneling and credential theft.
Russian-linked threat actor UAT-10820 utilizes ClearFake infection chains and WebDAV-hosted DLLs to deploy Amatera stealer and follow-on payloads like ZigCryptoStealer and NetSupport Manager.
DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.
SilkParasite is a China-nexus cyberespionage cluster targeting Central Asian government entities using a modular arsenal of seven RAT families, including five previously undocumented tools and AI-assisted tradecraft.
Silk Typhoon is suspected of exploiting a pre-authentication RCE chain in PaperCut NG and MF involving improper access control and unsafe class loading.
