Browse public community intelligence reports, source analysis, and threat research.
41 intel reports
Russian-speaking threat actors are exploiting a heap-based buffer overflow (CVE-2025-25249) in FortiGate devices to deploy PivotC2, an AI-assisted Node.js RAT for network tunneling and credential theft.
The Knight Office phishing kit uses Adversary-in-the-Middle (AiTM) techniques and device code phishing to bypass MFA and hijack Microsoft 365 session tokens.
The Dark Caracal threat actor is deploying a modular Go-based framework named GoCaracal that utilizes Ethereum smart contracts for resilient command-and-control infrastructure.
A cluster of trojanized npm packages delivers the RedShell Linux implant, which features an AI-driven post-exploitation layer called Red Agent.
TWINLOOT is a sophisticated Python implant utilizing SharePoint for tasking, Teams TURN relays for SOCKS5 tunneling, and headless Edge for stealthy Microsoft Graph API transport.
Lazarus Group's Famous Chollima unit utilizes stolen identities and AI-assisted workflows to infiltrate Western finance and technology firms as remote IT workers.
Lazarus group exploited a Windows AFD.sys zero-day (CVE-2026-68820) to deploy the FudModule rootkit against defense and aviation sectors via trojanized PDF software.
OnyxC2 is a sophisticated Malware-as-a-Service info-stealer and remote access toolkit targeting over 200 applications including crypto wallets, browsers, and 2FA extensions.
Gray-market services like Poison Claude and Ecomagent exploit cloud promotional credits and synthetic identities to resell discounted, proxied access to frontier AI models.
China-based APT Jewelbug conducts simultaneous government espionage across the Middle East and Asia alongside industrial-scale cryptocurrency fraud using a unified C2 framework.
