Browse public community intelligence reports, source analysis, and threat research.
103 intel reports
Settra ransomware targets consumer services and manufacturing sectors using MeshAgent RMM for persistence and Bring Your Own Vulnerable Driver (BYOVD) to disable security tools.
Researcher Asim Manizada released working exploits for four Linux kernel vulnerabilities (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) that enable local root access and potential remote crashes.
Researchers at Forever Security demonstrated 'BragJack', a technique using malicious browser extensions to hijack AI assistants in Chrome, Edge, Comet, Opera Neon, and Claude by manipulating trusted domains and network traffic.
The NightEagle APT group (APT-Q-95) is targeting Russian businesses by deploying the GhostContainer backdoor on Microsoft Exchange servers and utilizing legitimate tunneling tools for lateral movement.
ParaShells (CVE-2026-90894) allows a local non-admin macOS user to gain root access by exploiting a world-writable socket and argument injection in the Parallels Desktop background service.
Threat actors are actively exploiting CVE-2026-5430 in WSO2 API Manager using forged JWT tokens with unsupported signing algorithms to gain administrative access.
Multiple espionage threat actors, including China-aligned TA412, are deploying the BlueMoon exploit kit to chain Chrome V8 RCE and Windows kernel LPE vulnerabilities for malware delivery.
A threat actor designated TH-3BB targeted Thai ISP 3BB and Jasmine International using CVE-2024-21762 for initial access and MeshCentral for persistent command-and-control.
The ShieldCrash exploit targets CVE-2026-69414 to achieve arbitrary file read as SYSTEM by bypassing incomplete patches for the ShieldBreak vulnerability in Windows Defender.
KATARU is a newly observed IoT malware family that utilizes Linux local privilege escalation exploits and encrypted C2 to conduct DDoS attacks.
