Browse public community intelligence reports, source analysis, and threat research.
76 intel reports
Threat actors are chaining critical vulnerabilities CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 appliances to gain root access and pivot into internal corporate networks.
The Chinese cybercrime subgroup CylindricalCanine, part of GoldenEyeDog, targets financial organizations and certificate providers using a modified Gh0st RAT and sophisticated code-signing certificate theft.
Russian FSB Center 16 (Static Tundra) targets critical infrastructure by exploiting weak SNMP configurations and legacy Cisco vulnerabilities to exfiltrate device configurations.
UAT-7810, a China-nexus infrastructure specialist, builds Operational Relay Box (ORB) networks targeting SOHO and enterprise systems using the LEASH malware family for secondary espionage actors.
UAT-7810, a China-nexus threat actor, is expanding its LapDogs Operational Relay Box (ORB) network by compromising networking devices using an updated suite of custom Linux and Java-based malware.
China-nexus actor UAT-7810 is expanding its LapDogs Operational Relay Box network using new malware families like LONGLEASH and DOGLEASH to target networking and IoT devices.
Cavern Manticore, an Iran-nexus APT group, utilizes a modular .NET C2 framework targeting Israeli government and IT sectors through RMM abuse and DLL sideloading.
The Iranian threat actor Cavern Manticore is targeting Israeli IT providers and government sectors using the modular Cavern C2 framework and supply chain exploitation.
SystemBC is a Windows-based malware family used as a SOCKS5 proxy and persistent RAT by major ransomware groups to tunnel malicious traffic and execute payloads.
The ErrTraffic Malware-as-a-Service framework uses the ClickFix social engineering tactic and EtherHiding blockchain dead-drop resolvers to distribute infostealers and loaders through compromised WordPress sites and fake AI platforms.
