Browse public community intelligence reports, source analysis, and threat research.
13 intel reports
Suspected Lazarus Group operators are utilizing agentic AI for post-exploitation after compromising global PHP infrastructure via PHP2Shell vulnerabilities.
The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.
A Russian-speaking operator utilized a Log4Shell JNDI injection chain against Graylog servers to target Ukraine's national data-exchange ecosystem between May and September 2026.
A Chinese-speaking threat actor is leveraging the ARTEX agentic AI framework to automate reconnaissance and exploitation of South Korean financial institutions, resulting in large-scale PII theft.
Purple Ghosts compromised over 14,000 Dahua cameras globally using an authentication-bypass chain and P2P relay exploitation to install persistent backdoors and harvest credentials.
A Chinese-speaking operator nicknamed 'Miku' conducted a global campaign involving SQL injection, credential spraying, and LLM-assisted reconnaissance against government, military, and commercial targets in Pakistan, Vietnam, and Mexico.
Suspected Chinese threat actor Red Heron is exploiting CVE-2026-60004 in Gitea to deploy the JITTERLY implant and SIXZUT rootkit for source code theft and lateral movement.
A Russian-speaking operator compromised over 14,000 Dahua IP cameras globally, primarily in Ukraine and Russia, using authentication bypasses, P2P relay abuse, and credential brute-forcing.
Russian intelligence services APT28 (GRU) and FSB Center 16 are systematically compromising SOHO and enterprise routers to build global proxy networks and conduct DNS hijacking for credential theft.
NadMesh is an autonomous, Go-based botnet designed to harvest AI service credentials and exploit infrastructure including Docker, Kubernetes, and Model Context Protocol (MCP) services.
