Browse public community intelligence reports, source analysis, and threat research.
14 intel reports
German law enforcement and suspected state actors are bypassing end-to-end encryption by leveraging linked-device features to clone messenger accounts on WhatsApp, Signal, and Telegram.
ShinyHunters has evolved from a credential-theft crew into a resilient extortion brand and SaaS supply-chain threat, most recently exploiting PeopleSoft zero-days and third-party OAuth tokens.
Everest is a sophisticated .NET-based ransomware that employs aggressive lateral movement, service termination, and process self-protection while targeting Windows environments.
UNC6240 (ShinyHunters) is conducting mass exploitation of CVE-2026-35273 in Oracle PeopleSoft using WAF bypass techniques to deploy SIDEEYE backdoors and MeshCentral agents for extortion.
Threat actors utilized fraudulent Google Ads and dynamic Vercel redirects to target Ledger hardware wallet users, aiming to steal secret recovery phrases through a sophisticated phishing chain.
The PAYLOAD ransomware family hijacked Active Directory Group Policy Objects to deliver ransom notes and disable host security domain-wide without endpoint binaries.
The North Korean WaterPlum group uses fake job interviews and malicious development tools to compromise IT professionals, stealing over $10.7 million in cryptocurrency.
Threat actors are using fake Grand Theft Auto VI (GTA6) installers to distribute a multi-component malware package including RATs, infostealers, and a wiper.
The threat actor ShinyHunters and affiliated clusters are targeting SaaS platforms, specifically Salesforce, using vishing and OAuth integration abuse for data exfiltration and extortion.
The Russia-aligned Gamaredon group significantly updated its arsenal in 2025, deploying six new PowerShell tools and leveraging legitimate cloud services and tunnels to target Ukrainian military and government institutions.
