Browse public community intelligence reports, source analysis, and threat research.
15 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
Anthropic identifies multi-vector misuse of Claude AI models by state-sponsored actors (Russia, China, Iran), financially motivated groups (ShinyHunters), and commercial entities for cyber operations, surveillance, and conventional weapons development.
A Russian-speaking Aurora ransomware affiliate utilizes AI-assisted planning and Active Directory exploits to compromise over twenty organizations globally before deploying a Zig-based encryptor.
Attackers can achieve full Active Directory domain takeover in under one hour using legitimate protocols like Kerberos and SMB without deploying malware.
Certighost (CVE-2026-54121) is a critical improper authorization vulnerability in AD CS allowing low-privileged users to impersonate Domain Controllers by abusing unverified directory referrals.
Adversaries like Mirage Kitten and Cloud Atlas leverage Kerberoasting and DNS tunneling to bypass traditional security perimeters and exfiltrate data.
The financially motivated threat actor Woodgnat is deploying the stealthy Backdoor.Mistic via DLL side-loading to facilitate ransomware access for affiliates.
Evidence refutes the attribution of TAG-150 commodity Russian Malware-as-a-Service (MaaS) and ClixFlare infrastructure to the Iranian state actor MuddyWater.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
Cloud Atlas APT targets government and diplomatic entities in Russia and Belarus using a revamped toolset including VBCloud, PowerShower, and the new PowerCloud data exfiltration script.
