Browse public community intelligence reports, source analysis, and threat research.
123 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
SkyW4lker is a device-code phishing kit targeting Microsoft 365 users, primarily in the US technology and manufacturing sectors, to bypass MFA and obtain access tokens.
Russian threat actor APT28 compromised a NATO naval shipbuilder and other defense targets using the HOOKEDGE backdoor, a persistent SSH tunnel, and a custom reflective loader.
The XWorm 6.0 modular malware has resurfaced with over 35 plugins for data theft, ransomware, and persistence, primarily targeting Windows systems via phishing and malicious installers.
Threat actors Storm-3121 and Storm-3032 utilize passkey-themed social engineering and AiTM phishing to compromise Microsoft cloud identities for automated data exfiltration via Microsoft Graph.
Kimsuky (APT-C-55) utilizes phishing emails with malicious LNK files and supply-chain poisoning of the 'pybroker' library to steal sensitive data from financial and research sectors.
Attackers are bypassing the Microsoft 365 RejectDirectSend control by using empty SMTP envelope senders to deliver unauthenticated internal-looking spearphishing emails.
Akira ransomware targets global organizations across Windows and Linux platforms using double extortion, vulnerability exploitation, and credential theft.
Earth Sirrush (UAC-0099) utilizes evolving .NET malware, steganographic delivery, and trojanized applications to target Ukrainian government and logistics sectors for long-term espionage.
