Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
Kimsuky targeted South Korean groupware vendors to compromise downstream customers using new Gomir malware variants and credential harvesting techniques.
Iranian-affiliated APT actors are targeting internet-exposed PLCs from Rockwell, Schneider, and Siemens to disrupt U.S. critical infrastructure via project file manipulation.
Threat actors are chaining critical vulnerabilities CVE-2026-15409 and CVE-2026-15410 in SonicWall SMA1000 appliances to gain root access and pivot into internal corporate networks.
Adversaries can achieve remote code execution as SYSTEM or root by submitting crafted SVG files containing shell-invoking delegates to image-processing pipelines.
The SuccessKey threat actor is targeting Vite ecosystem developers using malicious scoped npm packages that deliver a Remote Access Trojan (RAT) via a multi-tier blockchain C2 infrastructure.
The Kali365 phishing kit abuses Microsoft and Google device code authentication flows to steal OAuth access tokens from US organizations across multiple sectors.
Threat actors are utilizing AI-enhanced text salting techniques to inject hidden benign content into phishing emails, successfully misguiding AI-powered security filters and LLM-based detection systems.
Attackers can abuse the legitimate Windows Bind Filter driver (bindflt.sys) to virtualize file paths, allowing malicious code to masquerade as trusted system files and blind EDR sensors.
TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.
UNC-RAID-M8280 uses a cross-platform Rust loader to deploy a customized Sliver C2 implant via abused third-party cloud storage and Cloudflare Tunnel infrastructure.
