Browse public community intelligence reports, source analysis, and threat research.
51 intel reports
The Skynet LLMjacking agent hijacks exposed AI models to autonomously scan for targets, harvest credentials, and deploy XMRig miners across 100,000 steps.
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
An unknown actor used a compromised ConnectWise Cloud Backup (SkyKick) application credential to sign in to customer Microsoft 365 tenants as the application itself, with Huntress reporting successful sign-ins in over 300 tenants.
Adversaries are actively exploiting multiple zero-day vulnerabilities in Citrix NetScaler ADC and Gateway to deploy persistence mechanisms including PHP-based webshells and remote management tools.
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
Suspected TraderTraitor group targets developers using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware via lookalike domains and GitHub.
The Ebury botnet hijacked 377 Tor exit relays to intercept SSH connections, steal passwords, and redirect encrypted mail traffic to plaintext ports.
CrocoRat is a Python-based remote access trojan and cryptocurrency stealer delivered via ClickFix social engineering and novel DNS TXT record payload staging.
Mir0Auth is a sophisticated phishing kit that abuses the Microsoft OAuth device authorization grant to harvest session tokens and bypass MFA.
