Browse public community intelligence reports, source analysis, and threat research.
42 intel reports
The threat actor Hyadina has rebranded Beast ransomware as GodDamn, utilizing the malicious PoisonX kernel driver to disable endpoint defenses via BYOVD attacks.
Unauthenticated attackers can bypass authentication on exposed Gitea instances to gain full administrative control by spoofing the X-WEBAUTH-USER HTTP header.
Russian-speaking threat actors are conducting a massive, automated credential-harvesting campaign named 'FortiBleed' targeting over 75,000 internet-facing Fortinet FortiGate firewalls and SSL VPNs across nearly 200 countries.
Initial Access Broker Woodgnat (KongTuke) is deploying the Mistic and MLTBackdoor RATs via social engineering and compromised WordPress sites to sell network access to major ransomware affiliates.
The ROOTBOY actor is deploying Prinz Eugen, a technically deliberate Go-based ransomware that prioritizes fresh data and utilizes anti-forensics to evade detection.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
The MovieBox Android malware masquerades as a premium streaming service to perform advanced reconnaissance, data exfiltration, and UI overlay attacks.
Security researchers have demonstrated how new native AI features in Microsoft SQL Server 2025 can be weaponized for covert data exfiltration, NTLM coercion, and Command and Control (C2) transport.
APT36 uses the Ghazwa spyware variant to conduct comprehensive surveillance on Android devices through media projection, audio recording, and extensive data exfiltration.
The Chinese threat actor VerdantBamboo is targeting unmonitored edge appliances such as firewalls and NAS devices to maintain persistence and bypass EDR security controls.
