Browse public community intelligence reports, source analysis, and threat research.
13 intel reports
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
The Cling botnet exploits multiple IoT vulnerabilities to deploy a worm-like malware that repurposes legitimate STUN traffic and infrastructure for command-and-control communications.
The Iranian state-aligned actor CL-STA-1178 is conducting the 'Blinder Tunnel' campaign targeting Iraqi critical infrastructure using trojanized coding challenges and living-off-the-cloud TTPs.
The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.
Nightmare Eclipse released ShieldBreak, a zero-day exploit bypassing previous patches to achieve SYSTEM privileges by exploiting a race condition in the Microsoft Malware Protection Engine.
Adversaries are globally leveraging the ClickFix social engineering technique to trick Windows and macOS users into executing malicious terminal commands that deliver infostealers and RATs.
Twill Typhoon leverages a supply chain compromise of the QuickFox VPN proxy to deliver the FDMTP implant through multi-stage loaders and execution guardrails.
Adversaries compromised maintainer accounts and CI/CD pipelines to distribute trojanized PyPI and npm packages targeting quantum computing researchers and Alibaba developers.
The threat actor Nightmare Eclipse released the RoguePlanet zero-day exploit (CVE-2026-50656) targeting a race condition in Microsoft Defender to achieve SYSTEM privileges on Windows 10 and 11.
