Browse public community intelligence reports, source analysis, and threat research.
82 intel reports
Initial Access Broker Woodgnat (KongTuke) is deploying the Mistic and MLTBackdoor RATs via social engineering and compromised WordPress sites to sell network access to major ransomware affiliates.
A chain of three vulnerabilities in the LiteLLM AI gateway allows low-privilege users to bypass authorization, escalate to administrative privileges, and execute arbitrary code on the host server.
Threat actor link99 systematically exploits abandoned Azure and DigitalOcean DNS zone delegations to host Thai gambling platforms under the authority of over 160 enterprise and government domains.
Threat actor EvilTokens uses device code flow phishing to bypass MFA and obtain Primary Refresh Tokens for persistent Microsoft 365 access.
EvilTokens and other phishing frameworks are increasingly abusing the Microsoft Device Code Flow to bypass MFA and conduct Business Email Compromise (BEC) at scale.
The Kali365 Live PhaaS platform enables large-scale device code phishing and AitM session capture targeting Microsoft 365 environments across multiple sectors.
The Phorpiex-linked Needle MaaS platform utilizes a modular Rust-based agent and browser spoofers to steal cryptocurrency seed phrases from over 1,900 victims.
APT28 (Fancy Bear) exploited a chain of vulnerabilities in Windows LNK files to achieve remote code execution and zero-click NTLM authentication coercion.
Storm-2755 uses AiTM techniques and SEO poisoning to hijack user sessions and divert payroll payments within Canadian organizations.
Canis C2 is a previously undocumented cross-platform surveillance framework targeting Japanese users with sophisticated mobile agents and OS-specific fingerprinting.
