Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
Critical unauthenticated path traversal in OpenWRT's bmx7-info CGI allows root compromise, alongside command injection vulnerabilities in Horde VFS.
The NoEscape wiper is a destructive 'troll' malware that locks user interfaces, hijacks executable associations, and performs raw disk writes to disable systems.
A global campaign uses heavily obfuscated JScript and AutoIt/Lua-based loaders disguised as .ttf files to deploy multiple RATs and infostealers via fileless execution.
HOLLOWGRAPH malware utilizes Microsoft Graph API to abuse Microsoft 365 calendars as a command-and-control channel for tasking and exfiltration.
The JadePuffer campaign utilized an autonomous LLM-driven agent to exploit a Langflow vulnerability, pivot to production databases, and execute a self-correcting ransomware operation.
Anonymous researcher 'bikini' released Exploitarium, a repository containing over 30 proof-of-concept exploits for unpatched vulnerabilities across multiple software projects, including critical flaws in libssh2 and Gitea.
Russian-affiliated threat actor CL-STA-1114 exploits a zero-click vulnerability in Zimbra Collaboration Suite to exfiltrate user credentials and email archives from global targets.
ACR Stealer (formerly Amatera Stealer) employs ClickFix social engineering, WebDAV delivery, and steganography to steal browser credentials and sensitive documents from Windows and macOS environments.
Egyptian threat actor codemado and associates leverage custom Evilginx forks and Device Code Flow abuse to target Microsoft 365 and cryptocurrency users.
Stealth Falcon utilized an LLM-accelerated WebDAV delivery lab to deploy PureRAT via working directory hijacking and DLL sideloading targeting Mexican enterprise users.
