Browse public community intelligence reports, source analysis, and threat research.
103 intel reports
The Miasma threat actor is deploying a self-spreading npm worm that utilizes a 'Phantom Gyp' technique to execute code during installation, targeting cloud credentials and AI coding assistants.
The Silver Fox threat actor targets Japanese and Chinese organizations using spear-phishing to deploy the modular 10FXRAT and the PoisonX kernel driver for security product bypass.
Nightmare Eclipse exploits a flaw in Windows Defender's Cloud Files remediation logic to achieve arbitrary file writes and SYSTEM execution via NTFS junctions and oplocks.
A high-severity local privilege escalation vulnerability in Amazon WorkSpaces' Skylight Workspace Config Service allows low-privileged users to gain SYSTEM access via a race condition and arbitrary file write.
The Dirty Frag vulnerability exploits logical defects in splice system calls and network protocol stacks to achieve stable, non-race condition privilege escalation on Linux systems.
The KongTuke group is leveraging Microsoft Teams social engineering to deploy ModeloRAT, escalate privileges via CVE-2023-36036, and harvest domain credentials using fake Windows lock screens.
MariaDB 11.4 and 11.8 series are vulnerable to a heap buffer overflow in the JSON_SCHEMA_VALID function, allowing authenticated users to escalate privileges and execute arbitrary OS commands.
The Nightmare-Eclipse toolset, including BlueHammer and RedSun, was observed in a live intrusion following initial access via compromised FortiGate VPN credentials.
Kernel-level anti-cheat systems utilize deep OS integration and rootkit-like behaviors to counter sophisticated threats including DMA hardware, BYOVD attacks, and hypervisor-based cheats.
Exploits named BlueHammer and RedSun leverage a TOCTOU race condition (CVE-2026-33825) in Windows Defender to achieve SYSTEM-level privilege escalation via filesystem manipulation.
