Browse public community intelligence reports, source analysis, and threat research.
6 intel reports
The threat actor k0t (aka CryptoFeel) is mass-exploiting edge appliances via CVE-2025-64446 and CVE-2026-0257 to steal credentials and facilitate ransomware attacks.
Purple Ghosts compromised over 14,000 Dahua cameras globally using an authentication-bypass chain and P2P relay exploitation to install persistent backdoors and harvest credentials.
A Russian-speaking operator compromised over 14,000 Dahua IP cameras globally, primarily in Ukraine and Russia, using authentication bypasses, P2P relay abuse, and credential brute-forcing.
Adversaries are using AI-assisted scripts and the snap7.dll library to target Internet-exposed Siemens S7 PLCs for reconnaissance and potential disruption across U.S. critical infrastructure.
Threat actors are using AI-generated scripts and the snap7 library to target Internet-exposed Siemens S7 Series PLCs across U.S. critical infrastructure sectors.
Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.
