Browse public community intelligence reports, source analysis, and threat research.
6 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
Russia-aligned threat actor UAC-0099 has evolved its custom MATCHBOIL downloader with enhanced obfuscation, sandbox evasion, and timer-based payload delivery targeting Ukrainian sectors.
CISA red teams achieved full domain compromise and sensitive system access in two organizations, highlighting risks in cloud identity permissions and Active Directory Certificate Services (ADCS).
Phantom Mantis utilizes a portfolio of kernel-mode tools, including the GentleKiller-related G12/G13 line and the DriverKiller BYOVD tool, to disable endpoint security products before ransomware deployment.
A state-sponsored threat group and Gunra ransomware actors exploited vulnerabilities in South Korean financial security software like AnySign4PC to deploy SIGNBT and COPPERHEDGE backdoors via watering holes.
A cryptocurrency-mining campaign exploits CVE-2026-33017, an unauthenticated RCE in Langflow, to deploy a Go-based miner with aggressive defense evasion and lateral movement capabilities.
