Browse public community intelligence reports, source analysis, and threat research.
26 intel reports
An unidentified threat actor utilizes renamed Python interpreters and custom ._pth files to execute malicious code without command-line arguments, eventually attempting to deploy ScreenConnect via a UAC bypass.
The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).
The CSuite operation targets US and European organizations using sophisticated phishing lures to steal Microsoft 365 sessions and deploy legitimate RMM tools like ScreenConnect for persistent endpoint access.
The researcher Nightmare Eclipse (aka MSNightmare) has released multiple proof-of-concept exploits targeting Windows Defender, Kaspersky, Avast, CrowdStrike, and NVIDIA drivers to achieve local privilege escalation or denial-of-service.
A confused deputy vulnerability in Google Cloud's Config Connector (KCC) allows Kubernetes users to escalate privileges to Organization Owner by submitting malicious IAMPolicyMember YAML files.
Attackers are exploiting a maximum-severity zero-day vulnerability in Cisco Identity Services Engine (ISE) to bypass authentication and gain root-level access.
Researcher 'Chaotic Eclipse' has released FalconFlank, a zero-day exploit abusing CrowdStrike Falcon's Office macro remediation to achieve SYSTEM privileges on Windows.
Exploits targeting Linux kernel interfaces and SUID helpers use copy-on-write bugs and namespace manipulation to achieve root access.
DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.
Security researcher Chaotic Eclipse has released multiple proof-of-concept exploits, including FalconFlank and ShieldBreak, targeting CrowdStrike, Kaspersky, and Microsoft Defender to achieve SYSTEM privileges.
