Browse public community intelligence reports, source analysis, and threat research.
17 intel reports
TeamPCP and related campaigns are targeting GitHub Actions CI runners using malware like Megalodon and Miasma to harvest credentials and persist within development pipelines.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
Vulnerabilities in the Google Cloud Vertex AI SDK for Python allow attackers to achieve cross-tenant RCE by hijacking model uploads via bucket squatting and malicious pickle deserialization.
The TeamPCP threat group is conducting a large-scale supply chain campaign using the 'Mini Shai-Hulud' worm to compromise npm packages, steal CI/CD and cloud credentials, and autonomously propagate.
Threat actors including Slow Pisces and TeamPCP are increasingly exploiting Kubernetes vulnerabilities and misconfigured RBAC to escalate privileges and compromise cloud environments.
The threat actor UAT-10608 is leveraging the React2Shell (CVE-2025-55182) vulnerability to deploy an automated framework that harvests credentials, SSH keys, and cloud tokens from Next.js applications.
Threat actor TeamPCP compromised the LiteLLM AI proxy via a cascading supply chain attack originating from malicious GitHub Actions in the Trivy vulnerability scanner.
