Browse public community intelligence reports, source analysis, and threat research.
11 intel reports
Suspected Lazarus Group operators are utilizing agentic AI for post-exploitation after compromising global PHP infrastructure via PHP2Shell vulnerabilities.
The threat actor 'General Boss' operates BigBear 2.0, an Evilginx2-based Phishing-as-a-Service framework targeting Microsoft 365 accounts globally using AiTM techniques to bypass MFA.
A Russian-speaking Aurora ransomware affiliate utilizes AI-assisted planning and Active Directory exploits to compromise over twenty organizations globally before deploying a Zig-based encryptor.
The suspected APT29 group (Cloaked Ursa) launched the Spring Ring campaign targeting over 150 employees with Microsoft Teams-based voice phishing to deploy RMM tools and custom PowerShell RATs.
Certighost (CVE-2026-54121) is a critical improper authorization vulnerability in AD CS allowing low-privileged users to impersonate Domain Controllers by abusing unverified directory referrals.
Security researchers analyzed a potential RCE chain in Microsoft Exchange Server SE involving MRSProxy authentication bypass and NTLM relay via PetitPotam.
Storm-2945, a sub-cluster of Midnight Blizzard (APT29), is hijacking hospitality Wi-Fi networks to deliver CornFlake RAT and ChocoShell infostealer via DNS poisoning and fake update prompts.
Attackers can abuse Active Directory Certificate Services (ADCS) to obtain trusted TLS certificates and hijack DNS to perform MITM attacks against Microsoft Entra ID logins.
DPRK-aligned actors are deploying macOS.Gaslight, a Rust-based backdoor that utilizes prompt injection payloads to subvert LLM-assisted malware analysis pipelines.
Windows Search URI handlers are vulnerable to an unpatched NTLM leakage primitive that allows remote attackers to capture Net-NTLMv2 hashes via a single link click.
