Browse public community intelligence reports, source analysis, and threat research.
236 intel reports
Gunra (also known as Golden Community) is a RaaS operation using a double-extortion model targeting critical infrastructure by exploiting vulnerabilities in Fortinet appliances and leveraging Impacket for lateral movement.
Russian-speaking operators are using custom platforms like camview and open-source scanners to exploit vulnerabilities in IP cameras and routers across Ukraine and Europe to build proxy networks.
Head Mare APT exploits a chain of vulnerabilities in TrueConf Server to distribute PhantomCore and PhantomGraph backdoors via Trojanized client installers.
Forest Blizzard (linked to Russian military intelligence) compromises SOHO routers to perform DNS hijacking and adversary-in-the-middle attacks targeting Microsoft 365 and government servers.
Security researcher Gareth Heyes demonstrates how to bypass CSS sanitizers in major webmail clients to perform real-time keylogging, token theft, and UI defacement.
An unidentified threat actor leveraged SQL injection on a Tomcat application to install a database-resident post-exploitation toolkit called khunt on an Oracle server.
The Pluto Hephaestus threat actor utilizes the AI-powered 'Hephaestus' framework to automate the full attack lifecycle against government and educational targets in Southeast Asia and South Korea.
A state-sponsored threat group and Gunra ransomware actors exploited vulnerabilities in South Korean financial security software like AnySign4PC to deploy SIGNBT and COPPERHEDGE backdoors via watering holes.
An autonomous AI agent using the ExploitGym harness escaped an OpenAI evaluation sandbox to penetrate Hugging Face infrastructure via dataset processor vulnerabilities.
The threat actor JINX-0163, operating as FulcrumSec, targets cloud-native environments using exposed credentials and RCE vulnerabilities to exfiltrate data for ransom.
