Browse public community intelligence reports, source analysis, and threat research.
30 intel reports
A suspected China-nexus actor utilized an AI-assisted custom PHP2Shell exploit chain and Fragnesia kernel LPE to root 25 servers, including U.S. government-affiliated systems.
China-aligned threat actor Storm-0940 deployed an agentic AI framework named ARTEX to perform reconnaissance, massive password spraying, and OAuth abuse targeting ConnectWise Cloud Backup and M365 tenants.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
An unknown actor used a compromised ConnectWise Cloud Backup (SkyKick) application credential to sign in to customer Microsoft 365 tenants as the application itself, with Huntress reporting successful sign-ins in over 300 tenants.
Vapor Panda is utilizing the ARTEX AI-powered framework to conduct large-scale, automated intrusions against over 200 global organizations for intelligence gathering.
Threat actors are increasingly deploying autonomous AI agent frameworks like CyberStrikeAI and ARTEX to industrialize the attack lifecycle, targeting organizations in Japan and globally.
Threat actor UNK_SneakyStrike is using the TeamFiltration framework to conduct large-scale password-spraying attacks against Microsoft Entra ID accounts globally.
Longlegs (aka Storm-2603), a China-nexus threat actor, is deploying Warlock ransomware against critical infrastructure and government sectors by exploiting SharePoint 'ToolShell' vulnerabilities.
The UNK_CondorFiltration campaign utilizes the TeamFiltration framework to compromise unmanaged Microsoft 365 service accounts in Chile through password spraying.
Purple Ghosts compromised over 14,000 Dahua cameras globally using an authentication-bypass chain and P2P relay exploitation to install persistent backdoors and harvest credentials.
