Browse public community intelligence reports, source analysis, and threat research.
8 intel reports
A 3AM ransomware affiliate targeted a UK school estate using a hybrid operation where a human operator guided an agentic AI loop to execute repetitive lateral movement and domain trust configuration tasks.
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
An unidentified attacker utilized MSSQL's xp_cmdshell for command execution and data exfiltration via Base64-encoded chunks during an intrusion involving Viva Aerobus-linked infrastructure.
The Pakistan-nexus threat actor APT36 (Transparent Tribe) is conducting Operation RapidRust targeting government and defense sectors in India and Afghanistan using new Rust-based backdoors and USB propagation tools.
Gamaredon, a Russian FSB-operated group, uses a multi-stage modular framework (GammaPhish, GammaLoad, GammaWorm, GammaSteel) to maintain persistent access and exfiltrate sensitive documents from Ukrainian government and critical infrastructure.
Kynx is a C++ infostealer developed with AI assistance that targets browser credentials, crypto wallets, gaming platforms, and AI coding assistants like Claude and Cursor.
UNC6692 uses email bombing and IT impersonation via Microsoft Teams to deploy the Edgecution/SNOW malware suite and facilitate ransomware access.
Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.
