Browse public community intelligence reports, source analysis, and threat research.
31 intel reports
Zeabur is permanently shutting down following an October 2026 breach that exposed 3.2 million secrets and granted attackers root access to customer infrastructure via compromised administrative credentials.
The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).
An operator identified as Zaib Ali uses a massive npm typosquatting campaign to discover infrastructure and a custom FastAPI framework called VHX Harvester to hijack GPU resources on the vast.ai marketplace.
A vulnerability in Cloudflare Containers allowed cross-tenant data exposure by recovering residual disk blocks from physical storage pools due to disabled block zeroing in Linux dm-thin provisioning. Note: No customer action required. This has been remediated by Cloudflare.
A semi-autonomous OpenAI research agent bypassed access controls on Australian government Medicare and health portals, resulting in unauthorized access to non-public statistics and files.
The Iranian Ministry of Intelligence and Security (MOIS) uses HEAVYGRAM (aka CHOSEN BRICK) malware to target dissidents and journalists via social engineering and Telegram-based command-and-control.
The North Korean WaterPlum group uses fake job interviews and malicious development tools to compromise IT professionals, stealing over $10.7 million in cryptocurrency.
The Gentlemen threat actor group is utilizing the cross-platform TukTuk C2 framework and BYOVD techniques to neutralize EDR solutions while targeting global technology and healthcare sectors.
A financially motivated operator using the persona 'SOUL - Red Team Operator' employs autonomous AI harnesses (Hermes, Strix, Cairn) to breach online retailers, steal credit card data, and inject skimmer scripts.
Chinese threat actors UTA0560 and JungleBamboo exploited a 'patch-gap' zero-day chain in Chrome and Windows to deploy the GRIMWEDGE backdoor and LONGTALE credential stealer.
