Browse public community intelligence reports, source analysis, and threat research.
1,185 intel reports
The GreatXML exploit by researcher Nightmare-Eclipse abuses the Windows Recovery Environment and Defender Offline Scan state to bypass BitLocker encryption using a malicious unattend.xml file.
The Miasma campaign targets @redhat-cloud-services npm packages using a multi-stage loader and Bun-executed credential stealer to exfiltrate secrets via GitHub APIs.
The Pakistan-aligned APT36 is deploying a new variant of the SHEETCREEP RAT using Google Sheets for C2 communication, targeting Indian diplomatic interests.
Attackers are exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to steal Admin API keys and inject malicious JavaScript for ClickFix social engineering attacks.
The MovieBox Android malware masquerades as a premium streaming service to perform advanced reconnaissance, data exfiltration, and UI overlay attacks.
Vulnerabilities in the Google Cloud Vertex AI SDK for Python allow attackers to achieve cross-tenant RCE by hijacking model uploads via bucket squatting and malicious pickle deserialization.
The Gentlemen ransomware, operated by the Phantom Mantis group (LARVA-368), has evolved from a RaaS affiliate into an independent operation featuring AI-assisted development and a self-propagating worm module.
The GreatXML zero-day exploit leverages Windows Defender Offline Scan and weak WinRE integrity checks to bypass BitLocker encryption via crafted unattend.xml files.
Suspected Lazarus Group (DPRK) operators are using malicious VS Code extensions like jupyter-powerdev to deliver a multi-stage backdoor utilizing SharePoint for C2 and Roslyn for in-memory execution.
Storm-1747 utilizes Tycoon 2FA to bypass MFA and maintain persistence through device registration and session token theft targeting Microsoft and Google cloud environments.
