Browse public community intelligence reports, source analysis, and threat research.
10 intel reports
The suspected PRC-nexus actor ARMORY CASTLE exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to deploy custom SAWFLY webshells and BARECLAW tunnelers for credential theft and lateral movement.
Adversaries are actively exploiting multiple zero-day vulnerabilities in Citrix NetScaler ADC and Gateway to deploy persistence mechanisms including PHP-based webshells and remote management tools.
Exploits targeting Linux kernel interfaces and SUID helpers use copy-on-write bugs and namespace manipulation to achieve root access.
Funnull-linked threat actors exploited a Sub-Store zero-day through poisoned CDN dependencies to deliver multi-platform malware including ProRAM, RingH23, and iOS exploit kits.
INC Ransomware and threat actor UTA0533 are weaponizing a zero-day exploit chain in SonicWall SMA 1000 series appliances to achieve root access and deploy memory-resident malware.
DirtyDecrypt (CVE-2026-31635) is a Linux kernel privilege escalation vulnerability where in-place decryption of unauthenticated RxGK network data enables arbitrary page-cache writes to SUID-root binaries.
The SleeperGem campaign involves compromised RubyGems that drop a persistent backdoor and native daemon specifically targeting developer machines while evading CI/CD environments.
A flaw in the Linux kernel's act_pedit traffic-control action allows unprivileged users to gain root access by poisoning cached setuid binaries in memory.
An unprivileged FreeBSD user can achieve local root access by exploiting a page-cache corruption vulnerability via kTLS-RX and the sendfile(2) system call.
Nightmare Eclipse exploits a flaw in Windows Defender's Cloud Files remediation logic to achieve arbitrary file writes and SYSTEM execution via NTFS junctions and oplocks.
