Browse public community intelligence reports, source analysis, and threat research.
90 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
The suspected PRC-nexus actor ARMORY CASTLE exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to deploy custom SAWFLY webshells and BARECLAW tunnelers for credential theft and lateral movement.
The bonto.io campaign uses malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys.
Russian-speaking actors NyashTeam and Kapchenka operate Salat Stealer (WEB_RAT), a Go-based MaaS targeting Windows for credential and cryptocurrency theft.
A China-linked operator utilized the AI-driven Cairn framework to conduct 66 intrusions against government and industry targets across Asia, leveraging LLM agents for automated exploitation.
The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).
FomoPeek versions 1.1 and 1.2 utilized kernel exploits and sandbox escapes to steal cryptocurrency private keys and sensitive data from iOS devices.
The CARBONATO botnet exploits unauthenticated Docker daemons to deploy an AI-driven Hermes Agent for automated post-exploitation and credential harvesting via Telegram.
An unidentified attacker utilized MSSQL's xp_cmdshell for command execution and data exfiltration via Base64-encoded chunks during an intrusion involving Viva Aerobus-linked infrastructure.
A vulnerability in Cloudflare Containers allowed cross-tenant data exposure by recovering residual disk blocks from physical storage pools due to disabled block zeroing in Linux dm-thin provisioning. Note: No customer action required. This has been remediated by Cloudflare.
