Browse public community intelligence reports, source analysis, and threat research.
76 intel reports
Chinese-speaking threat actor Gambling Goblin compromises Brazilian government web servers to deploy malicious Apache modules and a broad Linux toolkit for large-scale SEO manipulation and gambling fraud.
NovaCookies is an $320/month Adversary-in-the-Middle (AiTM) service that proxies Microsoft 365 logins to capture authenticated session cookies and bypass MFA.
The BengalSEO group, linked to WeConnect Solutions and Garage2Global, utilizes sophisticated SEO poisoning and a custom Traffic Distribution System (TDS) to deploy MayaBot malware and tech support scams.
Chinese-speaking threat actor TA4922 is utilizing PackClient, a modular C2 framework sold on Telegram, to target organizations in China and India with tax-themed phishing lures.
CISA red teams achieved full domain compromise and sensitive system access in two organizations, highlighting risks in cloud identity permissions and Active Directory Certificate Services (ADCS).
Certighost (CVE-2026-54121) is a critical improper authorization vulnerability in AD CS allowing low-privileged users to impersonate Domain Controllers by abusing unverified directory referrals.
The Dark Caracal threat actor is deploying a modular Go-based framework named GoCaracal that utilizes Ethereum smart contracts for resilient command-and-control infrastructure.
SynkLoader is a modular Windows malware family distributed via Microsoft Teams phishing that uses a bundled Python environment and in-memory components to facilitate credential theft, tunneling, and remote access.
TWINLOOT is a sophisticated Python implant utilizing SharePoint for tasking, Teams TURN relays for SOCKS5 tunneling, and headless Edge for stealthy Microsoft Graph API transport.
A suspected China-nexus actor, designated SilkParasite, utilizes a modular ecosystem of seven RAT families to target government economic bodies in Central Asia via DLL sideloading and Google Drive-backed C2.
