Browse public community intelligence reports, source analysis, and threat research.
42 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
SafePay ransomware actors target global critical infrastructure by exploiting edge device vulnerabilities and using legitimate administrative tools for data exfiltration and hybrid encryption.
The threat actor k0t (aka CryptoFeel) is mass-exploiting edge appliances via CVE-2025-64446 and CVE-2026-0257 to steal credentials and facilitate ransomware attacks.
Ransomware actors Spikey Scorpius and Tarnished Scorpius are exploiting an authentication bypass in PAN-OS GlobalProtect (CVE-2026-0257) to gain initial access, bypass MFA, and pivot to virtualization infrastructure.
Ransomware groups including Qilin and Settra are exploiting CVE-2026-0257 to bypass authentication in Palo Alto Networks GlobalProtect for unauthorized internal network access.
Akira ransomware targets global organizations across Windows and Linux platforms using double extortion, vulnerability exploitation, and credential theft.
Play (or Playcrypt) is a sophisticated ransomware group utilizing double extortion, custom information stealers like Grixba, and exploitation of vulnerabilities in FortiOS and Microsoft Exchange to target global organizations.
Everest is a sophisticated .NET-based ransomware that employs aggressive lateral movement, service termination, and process self-protection while targeting Windows environments.
Attackers can leverage leaked GitLab incoming email tokens to push code, execute CI/CD jobs, and bypass IP restrictions by spoofing merge request emails.
