Browse public community intelligence reports, source analysis, and threat research.
103 intel reports
Cluster CL-STA-0954 (UNC5820) exploited multiple Fortinet vulnerabilities, including CVE-2024-47575 and CVE-2025-61624, to deploy a novel memory-resident ARM64 implant named PEERSTITCH against telecommunications providers.
IronChain is a destructive malware build packaged with PyInstaller that utilizes multiple kernel drivers for process termination and persistence while intentionally discarding encryption keys to prevent data recovery.
Longlegs (aka Storm-2603), a China-nexus threat actor, is deploying Warlock ransomware against critical infrastructure and government sectors by exploiting SharePoint 'ToolShell' vulnerabilities.
An operator identified as Zaib Ali uses a massive npm typosquatting campaign to discover infrastructure and a custom FastAPI framework called VHX Harvester to hijack GPU resources on the vast.ai marketplace.
Sophisticated threat actor UAT-8616 and additional clusters are exploiting at least 12 vulnerabilities in Cisco SD-WAN, FMC, and ASA/FTD devices for persistent access and root escalation.
An unidentified operator using Simplified Chinese tools conducted iOS exploitation via the Coruna kit, multi-vector web attacks, and an AI-assisted gambling SEO campaign.
FomoPeek versions 1.1 and 1.2 utilized kernel exploits and sandbox escapes to steal cryptocurrency private keys and sensitive data from iOS devices.
Unauthenticated attackers are exploiting CVE-2026-73570 in Zimbra Collaboration Suite to deploy JSP webshells, escalate privileges via PAM, and exfiltrate mailbox data.
A vulnerability chain in OnePlus OxygenOS allows a no-permission malicious app to achieve full root access by exploiting AtlasService and a vendor-specific olc2 HAL.
The Russian-aligned Lunex Malware-as-a-Service platform utilizes a complex four-stage attack chain, including BYOVD-based EDR neutralization, to deploy a sophisticated information stealer and C2 agent.
