Browse public community intelligence reports, source analysis, and threat research.
97 intel reports
A suspected Russian-speaking actor used an AI-assisted toolkit (PentAGI) to exploit PaperCut vulnerabilities (CVE-2026-81578, CVE-2026-82078) and maintain persistence access across 45+ countries.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
SafePay ransomware actors target global critical infrastructure by exploiting edge device vulnerabilities and using legitimate administrative tools for data exfiltration and hybrid encryption.
Threat actors including Stardust Chollima and Sandworm are utilizing 'Browser Cache Smuggling' to deliver malware like Vidar Stealer and GeniexRAT by pre-fetching payloads into browser caches to bypass security scans and character limits.
The threat actor RareWolf uses a multi-stage batch script to deploy AnyDesk for unauthorized remote access, archive local data, and exfiltrate information via SMTP using the Blat utility.
An extensive phishing campaign impersonating the U.S. District Court targets over 100,000 companies using personalized lures to deliver the LodaRAT remote access trojan via malicious ISO files.
Russian threat actor APT28 compromised a NATO naval shipbuilder and other defense targets using the HOOKEDGE backdoor, a persistent SSH tunnel, and a custom reflective loader.
The CodeAIAssistant malicious VS Code extension abuses Model Context Protocol (MCP) install prompts and direct Node.js child_process spawning to execute arbitrary commands.
CastleStealer and CastleLoader use browser protection bypasses and ClickFix social engineering to exfiltrate sensitive data and deploy secondary RATs like NetSupport.
DarkCore is a remote access trojan (RAT) that uses a dedicated browser to reuse stolen sessions and route traffic through victims' IP addresses to bypass MFA and security controls.
