Browse public community intelligence reports, source analysis, and threat research.
103 intel reports
The MikroTrick exploit chain combines an SSH state-machine flaw with a login argument injection bug to achieve unauthenticated administrative control over MikroTik RouterOS devices.
The researcher Nightmare Eclipse (aka MSNightmare) has released multiple proof-of-concept exploits targeting Windows Defender, Kaspersky, Avast, CrowdStrike, and NVIDIA drivers to achieve local privilege escalation or denial-of-service.
Chinese threat actor UTA0565 utilized chained Chrome and Windows zero-day exploits through spoofed domains to deliver a custom obfuscated malware named CLEANGULP targeting government entities.
Adversaries can achieve SYSTEM privilege escalation by planting a malicious DLL at a non-existent ProgramData path referenced by a dangling COM registration and triggering it via custom COM marshaling.
The Gentlemen threat actor group is utilizing the cross-platform TukTuk C2 framework and BYOVD techniques to neutralize EDR solutions while targeting global technology and healthcare sectors.
A financially motivated operator using the persona 'SOUL - Red Team Operator' employs autonomous AI harnesses (Hermes, Strix, Cairn) to breach online retailers, steal credit card data, and inject skimmer scripts.
INC Ransomware threat actors utilize Bring Your Own Vulnerable Driver (BYOVD) tactics and dual ransom notes to pressure victims after exfiltrating data via tools like MEGASync.
Chinese threat actors UTA0560 and JungleBamboo exploited a 'patch-gap' zero-day chain in Chrome and Windows to deploy the GRIMWEDGE backdoor and LONGTALE credential stealer.
Attackers are exploiting a maximum-severity zero-day vulnerability in Cisco Identity Services Engine (ISE) to bypass authentication and gain root-level access.
Threat actors are chaining three JFrog Artifactory vulnerabilities to bypass authentication, escalate privileges to administrator, and deploy Rust-based backdoors.
