Browse public community intelligence reports, source analysis, and threat research.
25 intel reports
Russian state actor Star Blizzard is conducting large-scale phishing campaigns against Ukraine-aligned organizations using a novel malware delivery technique called RedFlick to deploy the CosmicPulse backdoor.
Longlegs (aka Storm-2603), a China-nexus threat actor, is deploying Warlock ransomware against critical infrastructure and government sectors by exploiting SharePoint 'ToolShell' vulnerabilities.
RATHat is an advanced Android banking trojan that abuses wireless debugging for shell access and utilizes Gemini LLM models for automated UI interaction and victim financial scoring.
Storm-2570 is a versatile ransomware affiliate utilizing consistent post-compromise tools like MeshAgent, ntdsutil, and s5cmd to deploy multiple ransomware families including Qilin and DragonForce.
A suspected Russian-speaking threat actor is using AI-powered agents to exploit a critical PaperCut NG/MF vulnerability chain (CVE-2026-81578 and CVE-2026-82078) to target the education sector globally.
Unidentified threat actors are exploiting multiple authentication bypass and remote code execution vulnerabilities in N-able N-central to compromise managed service providers and their downstream customers.
Suspected Chinese threat actor Red Heron is exploiting CVE-2026-60004 in Gitea to deploy the JITTERLY implant and SIXZUT rootkit for source code theft and lateral movement.
A Russian-speaking Aurora ransomware affiliate utilizes AI-assisted planning and Active Directory exploits to compromise over twenty organizations globally before deploying a Zig-based encryptor.
Attackers are exploiting CVE-2026-65400, a critical macOS Screen Sharing authentication bypass, to gain root access and deploy Monero miners on internet-exposed systems.
The threat actor Storm-2755, also known as Payroll Pirates, uses adversary-in-the-middle (AiTM) phishing and residential proxies to compromise Microsoft 365 accounts for targeted financial data collection.
