Browse public community intelligence reports, source analysis, and threat research.
1,190 intel reports
PolinRider threat actors hijacked two Joyfill npm packages to distribute an obfuscated five-stage malware chain using blockchain-based C2 resolution and a Python credential stealer.
Nebula Security researchers disclosed IonStack, an exploit chain combining a Firefox JIT miscompilation (CVE-2026-10702) and a 15-year-old Linux kernel futex flaw (CVE-2026-43499) to achieve remote code execution and root privileges.
ShinyHunters is targeting healthcare organizations using vishing to compromise SSO identities (Entra, Okta, Google) for rapid SaaS data exfiltration and extortion.
TOKYOCORE is a sophisticated C++ malware combining ransomware, data theft, and hardware-destructive wiper capabilities, attributed to the actor @meds.
The Silver Fox group is targeting Japanese industrial manufacturing organizations using a modular three-driver BYOVD framework to deploy ValleyRAT for persistent remote access.
INC Ransomware and threat actor UTA0533 are weaponizing a zero-day exploit chain in SonicWall SMA 1000 series appliances to achieve root access and deploy memory-resident malware.
A Chinese-speaking threat actor (Asia-Pacific Group) is utilizing leaked DarkSword exploit kit source code to target iOS 18.4-18.7 devices using GHOSTBLADE malware.
A sophisticated multi-stage campaign uses HijackLoader to deploy Vidar infostealers and the SnappyClient RAT via DLL side-loading and process hollowing.
The pro-Ukrainian threat actor Bearlyfy (Toy Ghouls) is targeting Russian organizations using their custom GenieLocker ransomware across Windows, Linux, and ESXi platforms.
The Payouts King actor targets corporate environments using Microsoft Teams vishing and Quick Assist to deploy a multi-variant Go-based backdoor named GoGRPC.
