Browse public community intelligence reports, source analysis, and threat research.
15 intel reports
Scattered Spider and related affiliates use vishing to trick employees into enrolling adversary-controlled passkeys, enabling mass data exfiltration from Microsoft 365 environments.
Storm-3168 (JADEPUFFER) utilizes compromised service principals to automate resource discovery, destruction, and credential theft across Microsoft Azure environments.
PREY-0058 (UNC6671) uses help-desk vishing and AiTM phishing to steal Microsoft 365 session tokens for bulk data exfiltration from SharePoint and Exchange via residential proxies.
CISA red teams achieved full domain compromise and sensitive system access in two organizations, highlighting risks in cloud identity permissions and Active Directory Certificate Services (ADCS).
ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.
Storm-2755 (Payroll Pirates) uses AiTM phishing and Microsoft Graph reconnaissance to hijack Microsoft 365 sessions and divert employee salaries.
The threat actor Storm-2755, also known as Payroll Pirates, uses adversary-in-the-middle (AiTM) phishing and residential proxies to compromise Microsoft 365 accounts for targeted financial data collection.
Wiz Research discovered CosmosEscape, a critical vulnerability in Azure Cosmos DB's Gremlin API allowing full cross-tenant read/write access to databases via a platform-wide master key.
Unauthenticated attackers can bypass authentication on exposed Gitea instances to gain full administrative control by spoofing the X-WEBAUTH-USER HTTP header.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
