Browse public community intelligence reports, source analysis, and threat research.
21 intel reports
SkyW4lker is a device-code phishing kit targeting Microsoft 365 users, primarily in the US technology and manufacturing sectors, to bypass MFA and obtain access tokens.
Russia-aligned threat actor UAC-0099 has evolved its custom MATCHBOIL downloader with enhanced obfuscation, sandbox evasion, and timer-based payload delivery targeting Ukrainian sectors.
China-aligned threat actor TA419 is conducting credential phishing campaigns against AI policy experts at US think tanks and universities using advanced AitM techniques.
Financially motivated actors are leveraging ARTEX, an open-source agentic AI pentesting tool, to automate breaches and data exfiltration from South Korean financial institutions.
The Brazilian threat actor Exilware utilizes the BraZetsu framework and Hestia Control Panel infrastructure to operate an initial access marketplace targeting Latin American organizations.
The SilkParasite campaign, active since 2022, utilizes shared SpiceRAT, NodeEdgeRAT, and NomadRAT infrastructure to target government and energy sectors across Central Asia.
China-aligned actor FamousSparrow is targeting Latin American governments with SparroWocky, a sophisticated C++ backdoor featuring advanced anti-analysis and modular execution capabilities.
The China-linked hacking group QTFY (associated with Nanjing Xinjiuwei Network Technology) utilizes the QScan and QTRouter distributed systems to exploit IoT devices and target critical infrastructure globally.
Threat actors are mass-scanning for exposed Vite development servers to exploit CVE-2026-39364 and steal AWS and Azure credentials.
The threat actor 'General Boss' operates BigBear 2.0, an Evilginx2-based Phishing-as-a-Service framework targeting Microsoft 365 accounts globally using AiTM techniques to bypass MFA.
