Reports filed under Threat Intelligence, newest first.
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt on October 17, 2026, four days before the public disclosure of two related CVEs. The attack originated from an IP linked to a commercial anonymization network, raising q…
This thread presents security analysis reports from three different locations, detailing connection attempts, usernames, passwords, and port usage over a specific period. The data highlights common attack vectors and user credentials used i…
The thread discusses two ransomware victims, steelco and ProMind IT, highlighting data breaches and the threat intelligence landscape. It underscores the growing impact of ransomware attacks on organizations and the importance of cybersecur…
The thread discusses two ransomware attacks on specific organizations, highlighting the impact of cyberattacks on institutions and the role of threat intelligence in tracking such incidents. It underscores the vulnerability of critical infr…
The posts share a list of specific domains and URLs identified as targets for a DDoSia attack. These posts provide threat intelligence data and links to JSON/CSV files containing the target list.
The posts report the detection of active GoPhish login pages hosted on specific IP addresses. This information is shared as threat intelligence to alert others to potential phishing infrastructure.
This thread reports multiple instances of GoPhish login pages detected on different IP addresses and ports, indicating potential phishing attacks or malicious activity. These detections are shared with cybersecurity tags, highlighting the i…
The thread provides periodic updates on Remote Desktop Protocol (RDP) honeypot data, listing Indicators of Compromise (IOCs) such as top scanning IPs, ASNs, and ISPs. This information is critical for cybersecurity professionals to identify …
A zero-day exploit targeting a popular open-source web administration tool was likely developed using AI, according to Google researchers. This highlights the growing role of AI in cybersecurity threats and raises concerns about the potenti…
The thread discusses a cybersecurity threat where the Lazarus Group is targeting macOS users through a phishing attack using ClickFix to trick them into executing malicious commands. The information is preliminary and unverified.
The thread discusses RDP honeypot IOCs collected over 24 hours, highlighting top IPs, ASNs, accounts, and other metrics related to network scanning activity. It includes links to datasets and mentions issues with API access.
The thread discusses a new APT group called GopherWhisper that is using popular communication platforms like Outlook, Slack, and Discord for malicious activities. This highlights a growing threat in cybersecurity as attackers exploit widely…
Two CVE alerts were posted regarding security vulnerabilities in the xerteonlinetoolkits project, highlighting potential risks in software security and prompting attention to threat intelligence and cybersecurity practices.
The thread consists of multiple CVE alerts from RedPacketSecurity, highlighting security vulnerabilities in various software and systems, including zinoui, hermes-webui, Red Hat Enterprise Linux AI, Red Hat Enterprise Linux 10, and Apache C…
The thread reports multiple new posts from the #Lockbit5 ransomware group, listing various domains associated with their activities. These posts highlight ongoing ransomware operations targeting different organizations, indicating potential…
The thread reports the detection of new configurations for DDosia, listing multiple host domains targeted by the DDoS attack. This indicates ongoing cyber threats and potential vulnerabilities in these domains.
The thread consists of multiple CVE alerts from Oracle Corporation, highlighting several security vulnerabilities in their software products such as Financial Services Analytical Applications Infrastructure, Life Sciences Empirica Signal, A…
The thread discusses two ransomware attacks on organizations, Laboratório Santa Luzia and Complete Aircraft Group, highlighting the impact of ransomware on businesses and the role of threat intelligence in identifying such incidents.
The thread reports the detection of Cobalt Strike Beacons on two different IP addresses, indicating potential cybersecurity threats. These detections are shared with links to detailed analyses, highlighting ongoing threat intelligence effor…