Browse public community intelligence reports, source analysis, and threat research.
137 intel reports
The Dark Caracal threat actor is deploying a modular Go-based framework named GoCaracal that utilizes Ethereum smart contracts for resilient command-and-control infrastructure.
SynkLoader is a modular Windows malware family distributed via Microsoft Teams phishing that uses a bundled Python environment and in-memory components to facilitate credential theft, tunneling, and remote access.
ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.
ToxNetV2 is an AArch64 Linux P2P botnet that integrates NVIDIA NIM LLM services into its controller's decision-making loop to propose operational actions.
Researchers discovered CoSnitch, a set of vulnerabilities in Microsoft Copilot Personal allowing one-click data exfiltration and persistent memory poisoning via malicious URLs and web summarization.
Unauthenticated attackers are chaining signature algorithm confusion and OpenSSL error handling vulnerabilities to bypass authentication and gain administrator access on WordPress sites using the miniOrange SAML SSO plugin.
TWINLOOT is a sophisticated Python implant utilizing SharePoint for tasking, Teams TURN relays for SOCKS5 tunneling, and headless Edge for stealthy Microsoft Graph API transport.
A Chinese-speaking threat actor is manually exploiting CVE-2026-33824, a critical double-free vulnerability in the Windows IKE Extension, to achieve pre-authentication remote code execution on VPN gateways.
NachoMDM is a research project demonstrating how a malicious MDM server can achieve silent SYSTEM code execution and UAC bypass by abusing the native Windows MDM enrollment process.
China-nexus threat actors are targeting Myanmar government personnel using a VHD-delivered Golang backdoor named QUICAgent that utilizes QUIC protocol for C2 communication.
