Browse public community intelligence reports, source analysis, and threat research.
1,186 intel reports
TeamPCP uses the Miasma worm to compromise developers and CI/CD pipelines by hijacking AI coding agents and poisoning package registries.
ITScape (CVE-2026-46316) is a high-severity guest-to-host escape vulnerability in KVM/arm64's vGIC-ITS emulation caused by a race condition leading to a double-put use-after-free.
The suspected Muddywater (APT28 variant) actor is deploying the Moodleuni C2 RAT using a fake Inno Setup installer to establish persistence via COM registration and startup shortcuts.
LegionLoader uses a multi-stage infection chain involving MSI files, DLL sideloading, and Python-based components to achieve stealthy execution and C2 communication.
Makop ransomware utilizes AES+RSA encryption and aggressive anti-recovery techniques such as deleting volume shadow copies and backup catalogs to target diverse Windows environments.
LCRYX is a multifunctional VBS-based ransomware and worm that performs extensive registry tampering, security software termination, and network-wide self-propagation.
The Ethereum Loader is a sophisticated multi-stage malware that uses blockchain-based C2 communication and masquerades as VMware components to evade detection.
ServiceNow instances running the Australia release or specific legacy configurations were vulnerable to unauthorized data queries via an unauthenticated REST API endpoint.
Threat actors are increasingly leveraging compromised Microsoft Intune administrative accounts to deploy malicious scripts and perform fleet-wide device wipes.
Phantom Stealer utilizes obfuscated VBScript droppers and .NET loaders with Telegram-based C2 infrastructure to exfiltrate browser credentials and system data.
