Browse public community intelligence reports, source analysis, and threat research.
29 intel reports
Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.
Aeza Group infrastructure is being used to deploy Go-based Mach-O malware through ClickFix social engineering, targeting macOS users to steal credentials and drain cryptocurrency wallets.
Adversaries can bypass passwordless protections by exploiting Google’s Cloud Authenticator onboarding and recovery flows to extract master keys or forge authentication signatures.
Russia-aligned actor TA488 is leveraging a critical XSS vulnerability in Outlook Web Access to deploy OWAReaper, a sophisticated browser-based implant for persistent mailbox access.
The XCSSET malware family has evolved to version 40, employing advanced in-memory execution, polymorphic payloads, and supply chain infection via poisoned Xcode projects targeting macOS developers.
An authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC) allows remote, unauthenticated attackers to execute commands and gain root access via crafted HTTP requests.
APT28 (Fancy Bear) is conducting a global campaign named FrostArmada, hijacking SOHO router DNS settings to facilitate adversary-in-the-middle attacks targeting Microsoft 365 credentials.
The MemGhost framework automates stealth memory injection into persistent AI agents like OpenClaw, enabling long-term compromise via a single adversarial email.
The threat actor O-UNC-066 is using vishing and a real-time operator-controlled phishing kit to trick users into enrolling attacker-controlled passkeys for Microsoft 365 access.
IRGC-affiliated actors utilize GigaWiper, a modular Golang-based backdoor combining disk wiping, fake ransomware, and surveillance capabilities against Israeli targets.
