Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
Russian intelligence services APT28 (GRU) and FSB Center 16 are systematically compromising SOHO and enterprise routers to build global proxy networks and conduct DNS hijacking for credential theft.
DPRK-aligned threat actors are targeting developers with fake coding interviews that deliver OTTERCOOKIE malware via SVG-based steganography.
ShinyHunters compromised the @asyncapi NPM organization via a GitHub Actions CI/CD exploit to deliver the Miasma modular runtime using import-time execution.
The Miasma v3 malware is currently targeting AsyncAPI npm packages via a compromised GitHub Actions release workflow to deliver a persistent Node.js remote access trojan.
An AppContainer with no capabilities can exploit a missing authorization check in Windows.UI.Storage.dll to hijack the ms-settings protocol and achieve SYSTEM privileges.
A sophisticated supply chain attack compromised the AsyncAPI npm organization to distribute the Miasma multi-stage dropper, targeting developers for credential theft and lateral movement.
Russian-speaking actor UAT-11795 is targeting US and European users with trojanized installers for MobaXterm, WebEx, and Zoom to deploy the novel Starland RAT and WLDR PowerShell agent.
A suspected North Korean cluster, linked to Sapphire Sleet, uses AppleScript to bypass macOS TCC protections and deploy the ptApp backdoor targeting cryptocurrency organizations.
The threat actor ShinyHunters and affiliated clusters are targeting SaaS platforms, specifically Salesforce, using vishing and OAuth integration abuse for data exfiltration and extortion.
Threat actors are spoofing OAuth client IDs in Microsoft Entra to perform stealthy user enumeration and credential validation without generating successful sign-in logs.
