Browse public community intelligence reports, source analysis, and threat research.
90 intel reports
China-nexus threat group UAT-8302 targets government entities in South America and southeastern Europe using a suite of shared and custom malware including NetDraft, CloudSorcerer, and VSHELL.
The Nightmare-Eclipse toolset, including BlueHammer and RedSun, was observed in a live intrusion following initial access via compromised FortiGate VPN credentials.
TeamPCP executed a supply chain attack on the elementary-data PyPI package using GitHub Actions injection to distribute a credential-stealing payload targeting data engineers.
NVIDIA's NemoClaw sandbox environment is vulnerable to data exfiltration and configuration poisoning via weaponized authorized tools and emoji-based evasion.
BlueNoroff is targeting Web3 and cryptocurrency executives using AI-generated deepfake meetings and ClickFix clipboard injection to deploy credential stealers.
North Korean state actor Sapphire Sleet targets cryptocurrency and finance sectors using social engineering and multi-stage AppleScript-based infection chains on macOS.
TeamPCP executed a cascading supply chain campaign using the CanisterWorm and Cloud Stealer malware to harvest credentials from GitHub Actions and PyPI packages.
Threat actor TeamPCP compromised multiple @fairwords npm packages to deploy CanisterWorm, a self-propagating malware that steals cloud credentials, crypto wallets, and Chrome passwords.
The threat actor TeamPCP compromised the popular litellm PyPI library to distribute a multi-stage credential harvester and Kubernetes lateral movement payload.
The threat actor TeamPCP compromised Aqua Security's Trivy project, injecting credential-stealing malware into official releases and forcing malicious updates to GitHub Actions.
