Browse public community intelligence reports, source analysis, and threat research.
31 intel reports
ShinyHunters is targeting healthcare organizations using vishing to compromise SSO identities (Entra, Okta, Google) for rapid SaaS data exfiltration and extortion.
Sophisticated threat actor UAT-8616 is targeting Cisco Catalyst SD-WAN components using zero-day vulnerabilities to gain root access and manipulate network fabric configurations.
Educational writeup documenting various SQL Injection (SQLi) techniques, including UNION-based, blind, error-based, and out-of-band exfiltration targeting common SGBDs.
Unauthenticated attackers can bypass authentication on exposed Gitea instances to gain full administrative control by spoofing the X-WEBAUTH-USER HTTP header.
The ShinyHunters extortion group (UNC6240) is exploiting a critical remote code execution zero-day in Oracle PeopleSoft to breach over 100 organizations, primarily in the education sector.
UNC6508, a PRC-nexus threat actor, targets medical and military research institutions using INFINITERED malware to harvest credentials and exfiltrate data via manipulated compliance rules.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
The EvilTokens Phishing-as-a-Service leverages Microsoft device code authentication flows and AI-driven automation to exfiltrate tokens and orchestrate large-scale Business Email Compromise (BEC) attacks.
FAMOUS CHOLLIMA (DPRK) distributes the MicrosoftSystem64 RAT via malicious npm packages, leveraging HuggingFace for binary updates and data exfiltration.
Spanish and Portuguese speaking threat actors are utilizing agentic AI to automate full-chain intrusions against government and financial sectors in Latin America.
