Browse public community intelligence reports, source analysis, and threat research.
25 intel reports
Bluekit PhaaS leverages advanced Browser-in-the-Middle (BitM) techniques and AI to bypass MFA by streaming live DOM interactions to victims.
The ShinyHunters extortion group (UNC6240) is exploiting a critical remote code execution zero-day in Oracle PeopleSoft to breach over 100 organizations, primarily in the education sector.
The ClickFix campaign has evolved to deploy PySoxy, an open-source Python SOCKS5 proxy, for redundant encrypted C2 access and persistence following initial social engineering.
The Gentlemen RaaS employs a multi-platform locker suite targeting Windows, Linux, and ESXi environments, utilizing SystemBC and Cobalt Strike for lateral movement and persistence.
A Russian-origin .NET remote access toolkit named CTRL uses weaponized LNK files to deploy modular payloads for credential theft, RDP session hijacking, and FRP-based reverse tunneling.
