Browse public community intelligence reports, source analysis, and threat research.
107 intel reports
A suspected Russian-speaking actor used an AI-assisted toolkit (PentAGI) to exploit PaperCut vulnerabilities (CVE-2026-81578, CVE-2026-82078) and maintain persistence access across 45+ countries.
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
KGB RAT is a Windows-based Malware-as-a-Service (MaaS) tool providing Remote Access Trojan capabilities, including credential theft, HVNC, ransomware, and cryptocurrency wallet swapping.
Kimsuky (APT-C-55) utilizes phishing emails with malicious LNK files and supply-chain poisoning of the 'pybroker' library to steal sensitive data from financial and research sectors.
CrocoRat is a Python-based remote access trojan and cryptocurrency stealer delivered via ClickFix social engineering and novel DNS TXT record payload staging.
The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).
The suspected TraderTraitor group is using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware for credential theft and persistent access.
The P7 variant of DarkSword targets iOS 18.x devices using chained vulnerabilities to exfiltrate keychain data, cryptocurrency wallets, and Apple Notes via a sophisticated two-way C2 architecture.
Mustang Panda uses a diplomatic-themed OIC invitation LNK to deliver the PlugX RAT through multi-stage PowerShell execution and DLL side-loading.
An operator identified as Zaib Ali uses a massive npm typosquatting campaign to discover infrastructure and a custom FastAPI framework called VHX Harvester to hijack GPU resources on the vast.ai marketplace.
