Browse public community intelligence reports, source analysis, and threat research.
97 intel reports
Phantom Stealer utilizes obfuscated VBScript droppers and .NET loaders with Telegram-based C2 infrastructure to exfiltrate browser credentials and system data.
Latrodectus malware utilizes MSI installers and PowerShell droppers to establish persistence and C2 communication while masquerading as legitimate SentinelOne security software.
The Sauron ransomware operation utilizes a multi-stage toolkit, including Telegram Bot API for data exfiltration and professional-grade system profiling for double extortion.
Security researchers have demonstrated how new native AI features in Microsoft SQL Server 2025 can be weaponized for covert data exfiltration, NTLM coercion, and Command and Control (C2) transport.
The GreenBlood ransomware group utilizes a Go-based malware featuring military-grade encryption and double extortion tactics to target global organizations.
The Miasma threat actor compromised 56 npm packages to steal CI/CD secrets and deploy persistent backdoors using a novel binding.gyp execution trigger.
The China-aligned APT group Webworm has shifted focus to European government entities using new backdoors EchoCreep and GraphWorm along with custom proxy tools.
A critical argument injection vulnerability in Gogs allows authenticated users to achieve RCE by injecting the --exec flag into git rebase during pull request operations.
Chinese-speaking threat actor lwxat operates a Malware-as-a-Service (MaaS) ecosystem centered on BadIIS, targeting web servers for SEO fraud and malicious redirection.
Seedworm (MuddyWater) conducted a global espionage campaign in early 2026 using Node.js loaders and DLL sideloading to target manufacturing, government, and financial sectors.
