Research reports
1,224 reports from 387 publishers45 added in the past week
7 reports, newest added first
Added Sat 24 Oct
ARMORY CASTLE Exploits BeyondTrust
Written by: Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, John Wolfram Introduction On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar)…
Vulnerabilities
Added Wed 14 Oct
Beyond source code: The files AI coding agents trust — and attackers exploit
As AI coding agents become deeply embedded in developer workflows, defenders must evolve their definition of malicious files and rethink how to protect against them. Autonomous AI agents operate across integrated development environments (IDEs), editors,…
Vulnerabilities
Added Wed 7 Oct
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
As an update to the June 2026 post, ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit, Mandiant and Google Threat Intelligence Group (GTIG) have identified renewed mass exploitation of CVE-2026-35273 by UNC6240 (ShinyHunters), along with…
State-sponsoredVulnerabilities
Added Thu 6 Aug
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
Mandiant and Google Threat Intelligence Group (GTIG) have identified an active compromise and extortion campaign attributed to UNC6240 (ShinyHunters) targeting Oracle PeopleSoft application infrastructure. The activity was observed between May 27, 2026, and…
Vulnerabilities
Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access
Since our February 2026 report on AI-related threat activity, Google Threat Intelligence Group (GTIG) has continued to track a maturing transition from nascent AI-enabled operations to the industrial-scale application of generative models within adversarial…
Vulnerabilities
Added Thu 14 May
The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors
Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices. Based on toolmarks in recovered payloads, we believe the exploit chain to be called DarkSword.…
VulnerabilitiesMobile
Added Wed 23 Apr 2025
apt37-reaper-the-overlooked-north-korean-actor.pdf
On Feb. 2, 2018, we published a blog detailing the use of an Adobe Flash zero-day vulnerability (CVE-2018-4878) by a suspected North Korean cyber espionage group that we now track as APT37 (Reaper). Recent examination of this group’s activities by FireEye…
State-sponsoredMalwareVulnerabilities
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.