Browse public community intelligence reports, source analysis, and threat research.
137 intel reports
Funnull-linked threat actors exploited a Sub-Store zero-day through poisoned CDN dependencies to deliver multi-platform malware including ProRAM, RingH23, and iOS exploit kits.
Threat actors are leveraging compromised WordPress sites and blockchain smart contracts to deliver Amatera password stealers and WebRTC stagers through ClickFix lures.
Salty Spider's long-standing Sality P2P botnet has been disrupted through a global sinkholing operation targeting its peer-to-peer communication and payload delivery infrastructure.
Grafana MCP servers were found vulnerable to a critical killchain involving session spoofing and a 9.1 CVSS SSRF vulnerability that allows unauthenticated access to internal infrastructure.
The Exilware threat group uses the AI-driven BraZetsu Python framework to compromise Windows hosts and monetize access via the 'Infect Marketplace.'
Virtualizor update infrastructure was compromised to deliver the 'nerat' RAT via malicious PHP modifications and a Java-based persistence mechanism on hypervisor nodes.
Toy Ghouls (Bearlyfy) is using new custom backdoors, mqtt-bird-agent and matrix-bird-agent, targeting Russian organizations via HiveMQ and Element C2 channels.
NovaCookies is an $320/month Adversary-in-the-Middle (AiTM) service that proxies Microsoft 365 logins to capture authenticated session cookies and bypass MFA.
Zhibotong (ZBT) electronics routers and white-labeled variants contain multiple pre-installed surveillance implants enabling unauthenticated root access, DNS hijacking, and credential exfiltration.
Certighost (CVE-2026-54121) is a critical improper authorization vulnerability in AD CS allowing low-privileged users to impersonate Domain Controllers by abusing unverified directory referrals.
