Intel Exchange

Threat actors are utilizing AI-assisted reverse engineering of Android and Flutter applications to discover and exploit vulnerabilities in backend APIs, bypassing front-end controls.

A China-linked operator utilized the AI-driven Cairn framework to conduct 66 intrusions against government and industry targets across Asia, leveraging LLM agents for automated exploitation.

Threat actors are actively exploiting a decade-old improper access control vulnerability in ProFTPD's mod_copy module to achieve unauthenticated remote code execution on Linux/Unix systems.

The Cl0p extortion operation has pivoted from traditional encryption-based ransomware to large-scale data theft via the exploitation of internet-facing Managed File Transfer (MFT) and enterprise software.

Threat actors are exploiting a remote code execution vulnerability in REDCap servers (CVE-2026-90817) to deploy XMRig miners using fileless techniques and steganography.

ShinyHunters (UNC6240) is targeting healthcare through identity-access extortion using vishing/AitM kits and mass exploitation of CVE-2026-35273 in Oracle PeopleSoft.

Threat actors are chaining two vulnerabilities in the AhsayCBS backup utility to achieve remote code execution and deploy XMRig cryptominers and JSP webshells.

Longlegs (aka Storm-2603), a China-nexus threat actor, is deploying Warlock ransomware against critical infrastructure and government sectors by exploiting SharePoint 'ToolShell' vulnerabilities.

ShinyHunters has evolved from a credential-theft crew into a resilient extortion brand and SaaS supply-chain threat, most recently exploiting PeopleSoft zero-days and third-party OAuth tokens.

Sophisticated threat actor UAT-8616 and additional clusters are exploiting at least 12 vulnerabilities in Cisco SD-WAN, FMC, and ASA/FTD devices for persistent access and root escalation.