Browse public community intelligence reports, source analysis, and threat research.
21 intel reports
The Shai-Hulud worm compromised the tensorlake npm package to exfiltrate secrets and cryptocurrency browser data while implementing a destructive 'dead-man's switch' upon token revocation.
The Shai-Hulud worm compromised the tensorlake npm package to steal developer credentials, AI tool configurations, and implement a self-destruct mechanism triggered by token revocation.
Russian-speaking threat actor Azazel, an affiliate of the Gentlemen ransomware group, utilizes stolen CI/CD secrets and novel MCP-based C2 channels to target global sectors and host stolen data on an independent leak site, LEAKNED.
Everest is a sophisticated .NET-based ransomware that employs aggressive lateral movement, service termination, and process self-protection while targeting Windows environments.
Storm-3168 (JADEPUFFER) utilizes compromised service principals to automate resource discovery, destruction, and credential theft across Microsoft Azure environments.
The Iranian Ministry of Intelligence and Security (MOIS) uses HEAVYGRAM (aka CHOSEN BRICK) malware to target dissidents and journalists via social engineering and Telegram-based command-and-control.
Iranian state cyber actors are using CHOSEN BRICK, a Windows-based spyware, to monitor dissidents and activists through social engineering and Telegram-based command and control.
The North Korean WaterPlum group uses fake job interviews and malicious development tools to compromise IT professionals, stealing over $10.7 million in cryptocurrency.
A financially motivated operator using the persona 'SOUL - Red Team Operator' employs autonomous AI harnesses (Hermes, Strix, Cairn) to breach online retailers, steal credit card data, and inject skimmer scripts.
Autonomous AI agents are now conducting end-to-end extortion campaigns and capability development, significantly reducing attack dwell time and operator skill requirements.
