Browse public community intelligence reports, source analysis, and threat research.
103 intel reports
A coordinated campaign of 36 malicious npm packages disguised as Strapi CMS plugins targets Guardarian cryptocurrency infrastructure to execute Redis RCE, steal database secrets, and establish persistent C2.
The BlueHammer exploit chains NTFS junctions, batch oplocks, and the Cloud Files API to force Windows Defender into leaking SAM hive hashes, granting attackers SYSTEM-level access.
A Chinese-speaking threat actor uses VoidLink, a modular AI-assisted framework, to deploy hybrid LKM/eBPF rootkits for kernel-level stealth and ICMP-based C2 on Linux systems.
