Browse public community intelligence reports, source analysis, and threat research.
236 intel reports
The Gentlemen ransomware, operated by the Phantom Mantis group (LARVA-368), has evolved from a RaaS affiliate into an independent operation featuring AI-assisted development and a self-propagating worm module.
OceanLotus (APT32) is leveraging SPECTRALVIPER in targeted supply-chain attacks against Vietnamese stock investors and infrastructure corporations to support domestic surveillance.
UNC6240 (ShinyHunters) exploited CVE-2026-35273 as a zero-day to target Oracle PeopleSoft infrastructure, primarily in the higher education sector, for data exfiltration and extortion.
ServiceNow instances running the Australia release or specific legacy configurations were vulnerable to unauthorized data queries via an unauthenticated REST API endpoint.
An OS command injection vulnerability in Ivanti Sentry allows unauthenticated remote attackers to achieve root-level code execution via a specific API endpoint. (CVE-2026-10520)
Russia's FSB-operated Gamaredon group leverages a modular VBScript and PowerShell arsenal targeting Ukraine through advanced persistence and multi-stage loading techniques.
Unknown threat actors are exploiting CVE-2026-5426 in KnowledgeDeliver LMS using hardcoded machine keys to achieve RCE and deploy BLUEBEAM web shells and Cobalt Strike.
Threat actors including Aeternum are exploiting CVE-2026-26980 in Ghost CMS to inject malicious JavaScript loaders that facilitate ClickFix social engineering attacks and malware delivery.
Cloud Atlas APT targets government and diplomatic entities in Russia and Belarus using a revamped toolset including VBCloud, PowerShower, and the new PowerCloud data exfiltration script.
A critical heap buffer overflow vulnerability (CVE-2026-42945) in the NGINX rewrite module allows unauthenticated remote attackers to trigger denial of service or code execution via crafted HTTP requests.
