Threat Intelligence
Threat Intelligence
Threat actor profiles, campaign analysis and advisories, mapped to MITRE ATT&CK. Shared at TLP:CLEAR.
Intel Drop 33 | SSHole: an OpenSSH login bypass exploited within hours
An OpenSSH login bypass (CVE-2026-123158, CVSS 8.1) affecting musl libc builds with PAM disabled, such as Alpine, was exploited on a honeypot about eight hours after disclosure.
Intel Drop 32 | One crafted SMS can knock Android off the network
CVE-2026-58882, the "SMS of Death": a crafted WAP Push message crashes Android's phone process and drops calls. Critical DoS, public PoC, no exploitation reported.
Intel Drop 31 | ARTEX: an AI pentest tool turned attack platform
Follow-up to Intel Drops 10 and 16: the infrastructure behind the South Korean bank intrusions, mapped by Hunt.io and RST Cloud.
Intel Drop 30 | Suspected broker k0t walks in through the network edge
Group-IB links a campaign that exposed 70,000+ credentials to mass scanning of FortiGate, FortiWeb and GlobalProtect edges.
Intel Drop 29 | APT29-linked "Poisoned Source" watering holes (Sekoia)
Poisoned websites pushing exploit chains to phones, linked to APT29 and reported by Sekoia.
Intel Drop 28 | SlippyNunchucks (ESET): Sogou Input Method hijack delivers DarkVigil
Sogou keyboard traffic hijacked to plant the DarkVigil backdoor, reported by ESET.
Intel Drop 27 | Emergency alert apps hijacked
Fake nuclear and chemical warnings were pushed through Ukraine's Air Alert app and a Russian emergency ministry app, hours apart.
Intel Drop 26 | LLMJacking: your AI bill is the payload
Stolen cloud keys drive $100K+ a day in fraudulent LLM charges, with 1-token requests used to test keys under alert thresholds.
Intel Drop 25 | XCPE: a botnet built in at the factory
Google disrupted XCPE, a firmware backdoor in 1.3M+ Android TV boxes and other IoT, which it says the maker built and sold access to.
Intel Drop 24 | Trojanised Claude Code extension plants SSH backdoors via Cursor
Tampered builds were live for about 11 hours on 29 Oct, on Windows and macOS.
Intel Drop 23 | North Korea's TraderTraitor drains $6.3B from Binance
No key theft was found: Binance's own signer was made to sign.
Intel Drop 22 | Telegram sticker claims: confirmed vs unverified
A conference talk claims a zero-click iOS chain through the rlottie sticker renderer.
Intel Drop 21 | Oracle EBS CVE-2026-101767: probed a week after patch
Unauthenticated SQL injection to RCE in EBS 12.2.3 to 12.2.15 (CVSS 9.8). Patched 20 Oct.
Intel Drop 20 | HTTP2Shell: one Brotli bug, many stacks, now exploited
CVE-2026-111497 was added to the CISA Known Exploited Vulnerabilities catalogue on 27 Oct 2026.
Intel Drop 19 | PHP2Shell and Fragnesia chain rooted about 25 firewall management servers
Follow-up to Intel Drops 05 and 14: a PHP2Shell and Fragnesia chain that rooted about 25 firewall management servers.
Intel Drop 18 | UAT-11473 KeyDrift implant on Cisco Catalyst SD-WAN (Talos)
The UAT-11473 KeyDrift implant on Cisco Catalyst SD-WAN, reported by Cisco Talos.
Intel Drop 17 | Volt Typhoon "Silent Train" covert relay network (Lumen Black Lotus Labs)
The Volt Typhoon "Silent Train" covert relay network, reported by Lumen Black Lotus Labs.
Intel Drop 16 | AI pentest tool turned extortion engine
ARTEX AI hit about 60 firms in 44 days and about 90 Korean organisations lost 8.2M records.
Intel Drop 15 | Fake 'IT Support' on Microsoft Teams
400+ incidents analysed: Teams chat, then vishing, then remote-management tools, with a payload in under 15 minutes.
Intel Drop 14 | PHP2Shell, week one: a Mirai botnet joins the rush
Follow-up to Intel Drop 05: millions of attempts, no confirmed compromise yet.
Intel Drop 13 | LiteLLM 1.107.0: an AI gateway turned credential thief
A poisoned LiteLLM release ran on every Python start, with no import needed.
Intel Drop 12 | Fortinet AI-found critical and high fixes (CVEs withheld until 10 Nov)
Fortinet fixes for critical and high flaws found with AI. The CVE details are withheld until 10 November.
Intel Drop 11 | Lazarus Operation FlashHole (Kaspersky), South Korea
Lazarus Operation FlashHole against South Korea, reported by Kaspersky.
Intel Drop 10 | Microsoft attributes ConnectWise app abuse to Storm-0940 (ARTEX framework)
Follow-up to Intel Drop 02: Microsoft attributes the ConnectWise app abuse to Storm-0940 and the ARTEX framework.
Intel Drop 09 | GitLab CVE-2026-110264: CVSS 10.0, 12 years deep
Unauthenticated RCE on self-managed GitLab CE/EE, in every release since 7.0.
Intel Drop 08 | SafePay ransomware: 600+ victims, backups first
Joint US-German-UK advisory AA26-293A (20 Oct 2026): SafePay wipes backups before it encrypts.
Intel Drop 07 | BRONZE SANDCASTLE: spying via trusted binaries
A new China-based cluster side-loads a rogue DLL through a renamed Sandboxie binary. Victims are in Asia and Africa.
Intel Drop 06 | Qilin & INC: GlobalProtect bypass to the hypervisor
PAN-OS CVE-2026-0257 is now used by ransomware crews to get past MFA and reach vCenter.
Intel Drop 05 | PHP2Shell: critical PHP runtime RCE flaws
CVSS 9.2, unauthenticated, PHP 5.4 onward affected: two chained memory flaws give remote code execution.
Intel Drop 04 | ClickFix goes as-a-service
ROMULUS: one panel, multiple payload routes, including LegionLoader and a browser-data stealer.
Intel Drop 03 | One vendor, 38 maritime victims?
n0n data-theft extortion hits ports and shipping: 38 listings across 18 countries, GCC included.
Intel Drop 02 | Backup app turned backdoor
A stolen ConnectWise Cloud Backup app credential was used to sign in to Microsoft 365 tenants on 15 Oct 2026.
Intel Drop 01 | Three threats from this week: BeyondTrust, AOMEI, FortiManager
Three stories, one theme: attackers going after the tools we trust to support, back up and manage our networks.