Browse public community intelligence reports, source analysis, and threat research.
1,190 intel reports
China-nexus actors use the Flying Eagle and successor Night Dragon frameworks to target Android devices with credential theft and remote surveillance.
Wiz Research discovered CosmosEscape, a critical vulnerability in Azure Cosmos DB's Gremlin API allowing full cross-tenant read/write access to databases via a platform-wide master key.
APT42 (suspected Iran-linked) is utilizing AI-assisted phishing and the SpearSpecter campaign to deliver an evolved modular TAMECAT backdoor targeting defense and nuclear energy sectors.
Chinese-speaking threat actors are using OctLurk and SilkLurk backdoors to target government, healthcare, and educational sectors in Central Asia via modular in-memory plugins.
JadeProx is a China-nexus threat cluster targeting Southeast Asia and Latin America using TriBack Loader and various tunneling tools for cyber espionage.
Researchers identified a lethal trifecta where a public AI triage agent was prompt-injected to trigger a privileged code-fixing agent, leading to RCE and credential theft in GitHub Actions.
Russia-aligned threat group UAC-0099 is delivering a multi-stage infection chain involving LUNCHPOKE, BURNYBEAR, and MATCHBOIL.V2 by abusing legitimate Notepad++ plugin loading routines.
Evidence refutes the attribution of TAG-150 commodity Russian Malware-as-a-Service (MaaS) and ClixFlare infrastructure to the Iranian state actor MuddyWater.
The Silver Fox threat actor utilizes a modular four-stage loader chain starting with a fake Flash Player to deliver AtlasRAT for credential theft and WeChat manipulation.
An authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC) allows remote, unauthenticated attackers to execute commands and gain root access via crafted HTTP requests.
