Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
The ROOTBOY actor is deploying Prinz Eugen, a technically deliberate Go-based ransomware that prioritizes fresh data and utilizes anti-forensics to evade detection.
The ErrTraffic Malware-as-a-Service framework uses the ClickFix social engineering tactic and EtherHiding blockchain dead-drop resolvers to distribute infostealers and loaders through compromised WordPress sites and fake AI platforms.
UNC6508, a PRC-nexus threat actor, targets medical and military research institutions using INFINITERED malware to harvest credentials and exfiltrate data via manipulated compliance rules.
CVE-2026-22778 allows remote attackers to execute arbitrary code on vLLM servers by chaining a heap address leak with a JPEG2000 decoder overflow in the video processing stack.
Midnight Blizzard leverages compromised Entra ID Agent Blueprints to pivot between tenants and escalate to Global Administrator using Temporary Access Passes.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
The AutoJack exploit chain leverages a confused deputy browsing agent to bypass localhost trust boundaries and achieve RCE in Microsoft's AutoGen Studio.
The Mastra AI framework suffered a supply chain attack involving over 140 compromised npm packages that deliver a cross-platform infostealer via a typosquatted dependency.
Dropping Elephant is using a China-themed decoy document to deliver a heavily reworked, in-memory RAT via DLL side-loading and Donut shellcode.
Financially motivated actors like Vanilla Tempest are leveraging ClickFix social engineering to deliver modular loaders including BabaDeda, Lorem Ipsum, and Potemkin, ultimately deploying ransomware like Rhysida.
