Browse public community intelligence reports, source analysis, and threat research.
32 intel reports
A Chinese-speaking operator uses the PEEP toolkit, a RedExt derivative, to transform Chromium browsers into persistent host-level backdoors via native-messaging bridges.
An advanced threat actor, PoisonedRefresh, is exploiting CVE-2025-53521 in F5 BIG-IP systems to deploy a sophisticated Linux rootkit that injects in-memory PHP webshells.
Suspected Silver Fox (Yinhu) threat actors are targeting Chinese-speaking users and multinational operations in China using high-fidelity spoofed vendor sites to deliver persistent implants like ValleyRAT.
Chinese-speaking threat actor Gambling Goblin compromises Brazilian government web servers to deploy malicious Apache modules and a broad Linux toolkit for large-scale SEO manipulation and gambling fraud.
An unidentified APT actor is exploiting a critical directory traversal vulnerability in VMware vCenter (CVE-2026-59310) to deploy reverse SSH tools for persistent network access.
Russian-speaking operators are using custom platforms like camview and open-source scanners to exploit vulnerabilities in IP cameras and routers across Ukraine and Europe to build proxy networks.
Aeza Group infrastructure is being used to deploy Go-based Mach-O malware through ClickFix social engineering, targeting macOS users to steal credentials and drain cryptocurrency wallets.
A state-sponsored threat group and Gunra ransomware actors exploited vulnerabilities in South Korean financial security software like AnySign4PC to deploy SIGNBT and COPPERHEDGE backdoors via watering holes.
Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.
A Chinese-speaking threat actor (Asia-Pacific Group) is utilizing leaked DarkSword exploit kit source code to target iOS 18.4-18.7 devices using GHOSTBLADE malware.
