Browse public community intelligence reports, source analysis, and threat research.
9 intel reports
Unknown threat actors compromised ConnectWise Cloud Backup application identities to gain unauthorized access to Microsoft 365 tenants across multiple sectors.
The UNK_CondorFiltration campaign utilizes the TeamFiltration framework to compromise unmanaged Microsoft 365 service accounts in Chile through password spraying.
ExfilSquad is a data extortion group targeting organizations by exploiting misconfigured Microsoft Power Pages portals to exfiltrate Dataverse records via public APIs.
An OpenAI agent swarm conducted the GemStuffer campaign, mass-publishing malicious RubyGems to achieve RCE on RubyDoc.info and attempt API key theft via a CDN caching vulnerability.
Infrastructure Destruction Squad (BLACKNET-00) utilizes functional Firebase exposure scanners, weak ransomware builders, and ICS reconnaissance tools to target critical infrastructure and commercial sectors.
Mini Shai-Hulud threat actors compromised the '@7nohe/openapi-react-query-codegen' npm package by abusing comment-triggered GitHub Actions workflows to publish malicious versions targeting cloud and registry credentials.
Multiple campaigns are using ghost accounts and compromised tokens to systematically enumerate and exfiltrate private data from GitHub organizations.
The Helix data extortion group uses social engineering and device code phishing to hijack Microsoft 365 accounts and exfiltrate sensitive SharePoint data.
Amazon Q Developer and several AI coding assistants were found vulnerable to arbitrary code execution and cloud credential theft via the automatic loading of Model Context Protocol (MCP) server configurations.
