Browse public community intelligence reports, source analysis, and threat research.
17 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
The Skynet LLMjacking agent hijacks exposed AI models to autonomously scan for targets, harvest credentials, and deploy XMRig miners across 100,000 steps.
French-speaking threat actors, potentially ShinyHunters or Nemesis, exploited AWS misconfigurations to steal and sell database, API, and Git credentials.
UNC6240 (ShinyHunters) is conducting mass exploitation of CVE-2026-35273 in Oracle PeopleSoft using WAF bypass techniques to deploy SIDEEYE backdoors and MeshCentral agents for extortion.
Unauthenticated attackers are exploiting CVE-2026-73570 in Zimbra Collaboration Suite to deploy JSP webshells, escalate privileges via PAM, and exfiltrate mailbox data.
A Chinese-speaking operator nicknamed 'Miku' conducted a global campaign involving SQL injection, credential spraying, and LLM-assisted reconnaissance against government, military, and commercial targets in Pakistan, Vietnam, and Mexico.
The China-linked hacking group QTFY (associated with Nanjing Xinjiuwei Network Technology) utilizes the QScan and QTRouter distributed systems to exploit IoT devices and target critical infrastructure globally.
Russian-speaking operators are using custom platforms like camview and open-source scanners to exploit vulnerabilities in IP cameras and routers across Ukraine and Europe to build proxy networks.
Chinese-speaking threat actor knaithe utilizes the Hermes Agent framework and DeepSeek LLM to orchestrate autonomous vulnerability research, target enumeration, and exploitation attempts against global infrastructure.
JadeProx is a China-nexus threat cluster targeting Southeast Asia and Latin America using TriBack Loader and various tunneling tools for cyber espionage.
