Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
Threat actors are exploiting an unauthenticated remote code execution vulnerability in Langflow (CVE-2026-33017) to deploy a multi-stage Monero cryptomining toolchain and spread via SSH key reuse.
SystemBC is a Windows-based malware family used as a SOCKS5 proxy and persistent RAT by major ransomware groups to tunnel malicious traffic and execute payloads.
Threat actors are using personal Gmail accounts and short.gy URL shorteners to deliver bilingual legal-threat lures for credential harvesting.
Chinese-speaking threat actor CL-STA-1062 is targeting government and energy sectors in Southeast Asia using a custom .NET backdoor named TinyRCT.
A flaw in the Linux kernel's act_pedit traffic-control action allows unprivileged users to gain root access by poisoning cached setuid binaries in memory.
The ErrTraffic framework utilizes the ClickFix social engineering tactic and EtherHiding technique to distribute various infostealers and loaders through compromised WordPress sites and AI-themed lures.
The ShinyHunters extortion group is targeting Oracle PeopleSoft instances globally using a zero-day vulnerability (CVE-2026-35273) and credential spraying to steal data.
The EDRChoker tool weaponizes Windows Policy-based Quality of Service (QoS) to throttle EDR process bandwidth to 8 bits per second, effectively isolating them from their management servers.
The 'Adblock for YouTube' Chrome extension uses excessive permissions and a remote-controlled injection architecture that could be weaponized for arbitrary code execution on any website.
DPRK-aligned actors are deploying macOS.Gaslight, a Rust-based implant that uses adversarial prompt injection to disrupt LLM-assisted malware analysis pipelines.
