Browse public community intelligence reports, source analysis, and threat research.
30 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
ClingSTUN is a Linux back-connect proxy backdoor that exploits numerous IoT vulnerabilities and abuses public STUN infrastructure for NAT traversal and remote command execution.
Purple Ghosts compromised over 14,000 Dahua cameras globally using an authentication-bypass chain and P2P relay exploitation to install persistent backdoors and harvest credentials.
Researcher Asim Manizada released working exploits for four Linux kernel vulnerabilities (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) that enable local root access and potential remote crashes.
Russian enterprises are facing sophisticated multi-stage attacks from NightEagle, Hacking Cat, and Toy Ghouls involving custom backdoors, wipers, and tunneling tools.
Unidentified threat actors are exploiting multiple authentication bypass and remote code execution vulnerabilities in N-able N-central to compromise managed service providers and their downstream customers.
LiteLLM vulnerabilities (CVE-2026-59821, CVE-2026-59822) enable unauthenticated attackers to bypass security controls, achieve root-level RCE, and exfiltrate cloud IAM credentials.
A Russian-speaking operator compromised over 14,000 Dahua IP cameras globally, primarily in Ukraine and Russia, using authentication bypasses, P2P relay abuse, and credential brute-forcing.
A Russian-speaking Aurora ransomware affiliate utilizes AI-assisted planning and Active Directory exploits to compromise over twenty organizations globally before deploying a Zig-based encryptor.
A 12-year-old critical flaw in PostgreSQL's logical decoding allows low-privileged replication accounts to execute arbitrary code and achieve full superuser persistence.
