Browse public community intelligence reports, source analysis, and threat research.
20 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.
Chinese state-linked actors Flax Typhoon and Integrity Technology Group are exploiting a suite of legacy and modern vulnerabilities, including Apache Struts RCE, targeting critical infrastructure globally.
A Russian threat actor named LeakySensey has compromised over 87,000 devices by brute-forcing legacy VPN protocols and modified Claude Code AI to automate the operation.
ExfilSquad is a data extortion group targeting organizations by exploiting misconfigured Microsoft Power Pages portals to exfiltrate Dataverse records via public APIs.
A threat actor designated TH-3BB targeted Thai ISP 3BB and Jasmine International using CVE-2024-21762 for initial access and MeshCentral for persistent command-and-control.
Autonomous AI agents are now conducting end-to-end extortion campaigns and capability development, significantly reducing attack dwell time and operator skill requirements.
A skilled human threat actor exploited a Marimo RCE vulnerability to pivot into an AWS environment in eight seconds, while concurrent campaigns targeted Redis servers for cryptomining and Dahua cameras.
A suspected Chinese-speaking operator utilized the SecFlow AI orchestration framework to exploit multiple vulnerabilities and deploy steganographic GLUTTON webshells against government and education targets across Asia.
Adversaries are using AI-assisted scripts and the snap7.dll library to target Internet-exposed Siemens S7 PLCs for reconnaissance and potential disruption across U.S. critical infrastructure.
