Browse public community intelligence reports, source analysis, and threat research.
21 intel reports
A suspected Chinese-speaking threat actor exploited vulnerabilities in ownCloud and WordPress to exfiltrate nuclear research records and naval contractor data in the Philippines.
The AnonyMousKIT PhaaS platform utilizes AI voice agents and multi-channel phishing to harvest Apple ID credentials, enabling the removal of Activation Lock on stolen devices.
Gray-market services like Poison Claude and Ecomagent exploit cloud promotional credits and synthetic identities to resell discounted, proxied access to frontier AI models.
Myxa VPN operates 737 malicious Chrome extensions impersonating 66 privacy brands to redirect all user browser traffic through controlled SOCKS5 proxies.
Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.
Russian intelligence services APT28 (GRU) and FSB Center 16 are systematically compromising SOHO and enterprise routers to build global proxy networks and conduct DNS hijacking for credential theft.
A sophisticated AiTM phishing campaign utilizes the PoisonSeeds kit to harvest AWS console credentials and bypass MFA via real-time challenge relaying.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
Threat actor link99 systematically exploits abandoned Azure and DigitalOcean DNS zone delegations to host Thai gambling platforms under the authority of over 160 enterprise and government domains.
The Weedhack Malware-as-a-Service (MaaS) campaign targets Minecraft players with custom JAR files that deploy multi-stage infostealers and RATs using Ethereum-based C2 infrastructure.
