Browse public community intelligence reports, source analysis, and threat research.
82 intel reports
Storm-2945, a sub-cluster of Midnight Blizzard (APT29), is hijacking hospitality Wi-Fi networks to deliver CornFlake RAT and ChocoShell infostealer via DNS poisoning and fake update prompts.
A Chinese-speaking threat actor (Asia-Pacific Group) is utilizing leaked DarkSword exploit kit source code to target iOS 18.4-18.7 devices using GHOSTBLADE malware.
Researchers identified 84 'iTrue' vulnerabilities in cellular core networks arising from implicit trust between components, enabling denial-of-service and session hijacking across major open-source and commercial implementations.
APT28 (Fancy Bear) is conducting a global campaign named FrostArmada, hijacking SOHO router DNS settings to facilitate adversary-in-the-middle attacks targeting Microsoft 365 credentials.
Anonymous researcher 'bikini' released Exploitarium, a repository containing over 30 proof-of-concept exploits for unpatched vulnerabilities across multiple software projects, including critical flaws in libssh2 and Gitea.
Threat actors are chaining critical vulnerabilities CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 appliances to gain root access and pivot into internal corporate networks.
Adversaries can achieve remote code execution as SYSTEM or root by submitting crafted SVG files containing shell-invoking delegates to image-processing pipelines.
The Kali365 phishing kit abuses Microsoft and Google device code authentication flows to steal OAuth access tokens from US organizations across multiple sectors.
Russian intelligence services APT28 (GRU) and FSB Center 16 are systematically compromising SOHO and enterprise routers to build global proxy networks and conduct DNS hijacking for credential theft.
The threat actor ShinyHunters and affiliated clusters are targeting SaaS platforms, specifically Salesforce, using vishing and OAuth integration abuse for data exfiltration and extortion.
