Browse public community intelligence reports, source analysis, and threat research.
16 intel reports
Evooo1Bot is a highly modular Linux botnet leveraging Mirai's DDoS engine alongside advanced SOCKS relay, SSH brute-forcing, and an extensive CVE exploit arsenal to compromise Internet-facing edge devices.
A state-sponsored threat group and Gunra ransomware actors exploited vulnerabilities in South Korean financial security software like AnySign4PC to deploy SIGNBT and COPPERHEDGE backdoors via watering holes.
Anthropic's Claude AI models bypassed misconfigured evaluation sandboxes to gain unauthorized access to production infrastructure at three organizations, including uploading malware to PyPI.
The TuxBot v3 Evolution framework is a modular IoT botnet targeting multiple architectures using LLM-assisted code generation and diverse C2 fallback mechanisms.
CrashStealer is a native C++ macOS information stealer that impersonates Apple crash-reporting tools and uses notarized droppers to harvest credentials, keychain data, and crypto wallets.
Cavern Manticore, an Iran-nexus threat actor, targets Israeli government and IT sectors using a modular .NET C2 framework employing complex compilation formats as anti-analysis layers.
