Browse public community intelligence reports, source analysis, and threat research.
13 intel reports
Suspected TraderTraitor group targets developers using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware via lookalike domains and GitHub.
Threat actors are exploiting a remote code execution vulnerability in REDCap servers (CVE-2026-90817) to deploy XMRig miners using fileless techniques and steganography.
The suspected TraderTraitor group is using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware for credential theft and persistent access.
PamStealer targets macOS users via fake 'Wavel' crypto wallet lures, utilizing a novel live server-side decryption utility (pkgunpack) and a Swift-based infostealer payload.
A cluster of trojanized npm packages delivers the RedShell Linux implant, which features an AI-driven post-exploitation layer called Red Agent.
The Evooo1Bot and GorillaBot threat actors are deploying highly modular Mirai-based malware targeting Linux systems and IoT devices to execute large-scale DDoS attacks and establish persistent proxy relays.
Unidentified threat actors are exploiting a critical macOS Screen Sharing authentication bypass (CVE-2026-65400) to gain root access and deploy Monero miners.
Adversaries compromised maintainer accounts and CI/CD pipelines to distribute trojanized PyPI and npm packages targeting quantum computing researchers and Alibaba developers.
Tengu is an evolved Mirai-derived IoT botnet featuring AEAD-encrypted C2, proxy capabilities, and aggressive self-defense mechanisms targeting Linux and Android systems.
ShinyHunters compromised the @asyncapi NPM organization via a GitHub Actions CI/CD exploit to deliver the Miasma modular runtime using import-time execution.
