Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
A logistics-themed spear-phishing campaign deploys CrySome RAT via a multi-stage chain involving UAC bypass, AMSI patching, and the WinDefCtl utility to disable endpoint defenses.
The Helix data extortion group uses social engineering and device code phishing to hijack Microsoft 365 accounts and exfiltrate sensitive SharePoint data.
Everest is a Russian-speaking ransomware group utilizing a triple-stream business model including file encryption, initial access brokerage, and paid corporate insider recruitment.
An unauthenticated remote attacker can achieve kernel-mode code execution or denial-of-service by exploiting an integer overflow in the Windows HTTP.sys driver over TLS connections.
Russian-speaking threat actors are exploiting CVE-2026-35616 in FortiClient EMS to deploy EKZ Stealer and FortigateSniffer, facilitating credential harvesting and subsequent ransomware attacks by INC Ransom and Lynx.
The Hyadina threat group is deploying the rebranded GodDamn ransomware, utilizing a Microsoft-signed PoisonX kernel driver to disable EDR and antivirus software.
QuimaRAT is a cross-platform Java-based Remote Access Trojan sold as a service, targeting Windows, Linux, and macOS environments through modular encrypted plugins.
The WP-SHELLSTORM campaign targets WordPress and Joomla installations at scale using automated exploit scanners and webshells for access brokerage.
The threat actor O-UNC-066 is using vishing and a real-time operator-controlled phishing kit to trick users into enrolling attacker-controlled passkeys for Microsoft 365 access.
The China-aligned threat actor UNK_MassTraction is exploiting Roundcube vulnerabilities to deploy IceCube and VShell backdoors against US and Canadian university physics departments.
