Browse public community intelligence reports, source analysis, and threat research.
40 intel reports
Blackpoint APG identified Miraak, a modular post-exploitation framework using PostgreSQL/Timescale for C2 communication and featuring Cobalt Strike BOF compatibility.
A Chinese-speaking threat actor is manually exploiting CVE-2026-33824, a critical double-free vulnerability in the Windows IKE Extension, to achieve pre-authentication remote code execution on VPN gateways.
The RMRLX malware family uses a multi-stage JavaScript and PowerShell loader to deploy LxBaseRAT, a sophisticated .NET tool targeting browser credentials, cryptocurrency wallets, and Discord tokens.
An unidentified APT actor is exploiting a critical directory traversal vulnerability in VMware vCenter (CVE-2026-59310) to deploy reverse SSH tools for persistent network access.
Chinese-speaking threat actor knaithe utilizes the Hermes Agent framework and DeepSeek LLM to orchestrate autonomous vulnerability research, target enumeration, and exploitation attempts against global infrastructure.
PolinRider threat actors hijacked two Joyfill npm packages to distribute an obfuscated five-stage malware chain using blockchain-based C2 resolution and a Python credential stealer.
A sophisticated supply chain attack compromised the AsyncAPI npm organization to distribute the Miasma multi-stage dropper, targeting developers for credential theft and lateral movement.
Adversaries can exploit Azure Container Registry permissions to push malicious images, modify ACR Tasks, and abuse Managed Identities for secret exfiltration and remote code execution.
The TuxBot v3 Evolution framework is a modular IoT botnet targeting multiple architectures using LLM-assisted code generation and diverse C2 fallback mechanisms.
The WP-SHELLSTORM campaign targets WordPress and Joomla installations at scale using automated exploit scanners and webshells for access brokerage.
