Browse public community intelligence reports, source analysis, and threat research.
11 intel reports
The suspected PRC-nexus actor ARMORY CASTLE exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to deploy custom SAWFLY webshells and BARECLAW tunnelers for credential theft and lateral movement.
ParaShells (CVE-2026-90894) allows a local non-admin macOS user to gain root access by exploiting a world-writable socket and argument injection in the Parallels Desktop background service.
Exploits targeting Linux kernel interfaces and SUID helpers use copy-on-write bugs and namespace manipulation to achieve root access.
A China-nexus threat actor is actively exploiting a critical path traversal flaw in VMware vCenter (CVE-2026-59310) to deploy the linuxFile backdoor and Babuk-derived ransomware across hypervisors.
Funnull-linked threat actors exploited a Sub-Store zero-day through poisoned CDN dependencies to deliver multi-platform malware including ProRAM, RingH23, and iOS exploit kits.
Attackers are exploiting CVE-2026-65400, a critical macOS Screen Sharing authentication bypass, to gain root access and deploy Monero miners on internet-exposed systems.
The SleeperGem campaign involves compromised RubyGems that drop a persistent backdoor and native daemon specifically targeting developer machines while evading CI/CD environments.
The Miasma campaign targets @redhat-cloud-services npm packages using a multi-stage loader and Bun-executed credential stealer to exfiltrate secrets via GitHub APIs.
The Chinese threat actor VerdantBamboo is targeting unmonitored edge appliances such as firewalls and NAS devices to maintain persistence and bypass EDR security controls.
The TeamPCP threat group is conducting a large-scale supply chain campaign using the 'Mini Shai-Hulud' worm to compromise npm packages, steal CI/CD and cloud credentials, and autonomously propagate.
