Browse public community intelligence reports, source analysis, and threat research.
21 intel reports
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
Akira ransomware targets global organizations across Windows and Linux platforms using double extortion, vulnerability exploitation, and credential theft.
China-aligned threat actor TA419 is conducting credential phishing campaigns against U.S. AI policy experts using Adversary-in-the-Middle (AitM) techniques and a customized Frameless BitB kit.
Iranian state cyber actors are using CHOSEN BRICK, a Windows-based spyware, to monitor dissidents and activists through social engineering and Telegram-based command and control.
The North Korean WaterPlum group uses fake job interviews and malicious development tools to compromise IT professionals, stealing over $10.7 million in cryptocurrency.
An unidentified ransomware-related threat actor is using SloppyRAT, a new multi-stage malware, to establish network footholds via ClickFix lures and blockchain-based C2 resolution.
PREY-0058 (UNC6671) uses help-desk vishing and AiTM phishing to steal Microsoft 365 session tokens for bulk data exfiltration from SharePoint and Exchange via residential proxies.
The BlueKit threat actor group is conducting a sophisticated Phishing-as-a-Service campaign targeting financial sector CEOs using browser-in-the-middle techniques and post-authentication ScreenConnect delivery.
Certighost (CVE-2026-54121) is a critical improper authorization vulnerability in AD CS allowing low-privileged users to impersonate Domain Controllers by abusing unverified directory referrals.
Storm-2755 (Payroll Pirates) uses AiTM phishing and Microsoft Graph reconnaissance to hijack Microsoft 365 sessions and divert employee salaries.
