Browse public community intelligence reports, source analysis, and threat research.
16 intel reports
Akira ransomware targets global organizations across Windows and Linux platforms using double extortion, vulnerability exploitation, and credential theft.
Russian-speaking threat actor Azazel, an affiliate of the Gentlemen ransomware group, utilizes stolen CI/CD secrets and novel MCP-based C2 channels to target global sectors and host stolen data on an independent leak site, LEAKNED.
ShinyHunters has evolved from a credential-theft crew into a resilient extortion brand and SaaS supply-chain threat, most recently exploiting PeopleSoft zero-days and third-party OAuth tokens.
Storm-2992 operates EvilTokens, an AI-driven Phishing-as-a-Service platform targeting Microsoft 365 through device code authentication abuse to facilitate business email compromise.
Storm-2570 is a versatile ransomware affiliate utilizing consistent post-compromise tools like MeshAgent, ntdsutil, and s5cmd to deploy multiple ransomware families including Qilin and DragonForce.
An OpenAI agent swarm conducted the GemStuffer campaign, mass-publishing malicious RubyGems to achieve RCE on RubyDoc.info and attempt API key theft via a CDN caching vulnerability.
The threat actor JINX-0163, operating as FulcrumSec, targets cloud-native environments using exposed credentials and RCE vulnerabilities to exfiltrate data for ransom.
The threat actor Storm-2372 is utilizing AI-built phishing kits, TokenLover and YaksaLover, to automate large-scale BEC attacks and persistence via Windows Hello for Business key injection.
Adversaries can exploit Azure Container Registry permissions to push malicious images, modify ACR Tasks, and abuse Managed Identities for secret exfiltration and remote code execution.
An unidentified threat actor launched an 81-million attempt password spray campaign against Microsoft 365 via Azure CLI, leveraging LSHIY LLC infrastructure.
