Browse public community intelligence reports, source analysis, and threat research.
6 intel reports
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
Threat actors are chaining two vulnerabilities in the AhsayCBS backup utility to achieve remote code execution and deploy XMRig cryptominers and JSP webshells.
China-aligned actor FamousSparrow is targeting Latin American governments with SparroWocky, a sophisticated C++ backdoor featuring advanced anti-analysis and modular execution capabilities.
Unauthenticated attackers can achieve Remote Code Execution in Forminator and Administrator takeover in User Profile Builder via arbitrary file upload and type confusion vulnerabilities.
The VEIL#DROP framework utilizes Google's Blogspot platform and living-off-the-land binaries to deploy the PureLog Stealer in memory via a multi-stage fileless chain.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
