REPORT1 SOURCE
Making the Most of a Security Incident
How to shift from firefighting to fire suppression.
First reported Jul 24, 2020 01:11 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordÆ / PUBLIC MALWARE INTELLIGENCE
Follow the evidence.
Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
61 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Review source update dates and status
- intelligence_src_74dcea1e7d16bc2a75Partial refreshLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
REPORT1 SOURCE
Old Protocols, New Exploits: LDAP Unwittingly Serves DDoS Amplification Attacks
A new DDoS attack vector that leverages LDAP for reflection-amplification attacks is seeing increased usage.
First reported Nov 15, 2016 08:00 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Application Protection Report 2019, Episode 5: API Breaches and the Visibility Problem
API use has grown tremendously as applications grow more decentralized. Some large apps have hundreds of APIs, and mobile apps depend on them completely.
First reported Aug 13, 2019 16:54 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Sensor Intel Series: Top CVEs in July 2022
Learn which CVEs attackers scanned for the most in July 2022, and how it compares with the rest of the year.
First reported Aug 22, 2022 23:26 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
CASI Leaderboard Shifts: Sugar-Coated Poison, and the Expanding AI Attack Surface
AI Security Insights – March 2026
First reported Mar 05, 2026 18:00 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Bots Target Retailers for Black Friday Bargains
Did automation targeting retail companies rise towards Black Friday 2022?
First reported Nov 17, 2023 21:50 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Dridex Update: Moving to US Financials with VNC
Ongoing campaign analysis has revealed that Dridex malware's latest focus has strongly shifted in recent months to US banks.
First reported Apr 26, 2016 07:00 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Top Attacks Against Financial Services Organizations 2017–2019
Attackers are targeting financial services organizations with brute force, credential stuffing, and DoS attacks. See how you can mitigate the risks.
First reported Apr 27, 2020 19:00 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Wait, Don’t Throw Out Your Firewalls!
Yes, the perimeter has shifted, but firewalls still have a place in your network. They’re just not alone anymore.
First reported Apr 04, 2017 07:00 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Three Ways AI Can Hack the U.S. Election
The growing capability of AI content poses three very real threats to modern elections. We explain each, and take a glimpse at a possible solution to the growing AIpocalypse.
First reported Oct 28, 2024 00:00 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Advanced Attackers: Stealthy, Patient, Dangerous
Advanced attackers are considered a top threat by CISOs. Although they are rare, their stealthy determination to learn everything about a target before they strike makes them especially dangerous.
First reported May 31, 2018 07:00 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Regional Threat Perspectives, Fall 2019: Russia
The same countries that attacked the rest of the world also attacked systems in Russia, but from different networks and IP addresses.
First reported Dec 23, 2019 15:59 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Russia Attacks Global Network Infrastructure Through Vulnerabilities That Extend Far Beyond Their Targets
US-CERT TL18-106A alert underscores how insecure Internet systems really are and that ignoring the problem only increases the collateral damage.
First reported May 04, 2018 07:00 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Regional Threat Perspectives: United States
Attackers using IP addresses in Vietnam, China, and Russia focused on attacking applications over Samba, SSH, and HTTP.
First reported May 02, 2019 15:33 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Introducing the CASI Leaderboard
Explore the new AI security index for emerging trends in AI security.
First reported Sep 29, 2025 16:00 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
If I Had to Do It Over Again, Part 3
More stories from CISOs who describe how they would “do it over” again in some of their early security program deployments.
First reported Apr 18, 2019 14:51 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Cloud Takeover: Mass Scanning for Exposed Vite Endpoints (CVE-2026-39364)
Sensor Intel Series: September 2026 CVE Trends
First reported Sep 11, 2026 17:50 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Weekly Threat Bulletin – April 8th, 2026
These are the top threats you should know about this week.
First reported Apr 08, 2026 18:08 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Cyberattacks Targeting South Africa, January through June 2021
South Africa’s cyberattack landscape saw targeting of Scryba, PHP, and CVE-2017-9841 web vulnerabilities.
First reported Sep 11, 2021 06:04 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Adversarial Poetry and the Efficacy of AI Guardrails
We investigate the rise of adversarial poetry in AI security. Understand how metaphor-based exploits circumvent guardrails and the defenses we need for LLMs moving forward.
First reported Dec 11, 2025 23:29 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
2021 Application Protection Report: Of Ransom and Redemption
The 2021 version of F5’s continuing analysis of the application security threat landscape explores ransomware, payment card theft, and account takeover.
First reported May 18, 2021 23:53 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Malware Targeting Bank Accounts Has a Swapping Pattern
F5 Labs analysts discovered a target pattern in the IBAN number formats as well as weekly changes to the script injection content. In May 2016, the F5 Security Operations Center (SOC) detected a generic form grabber and IBAN (International Bank...
First reported Sep 01, 2016 07:00 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
Sensor Intel Series: Top CVEs in November 2023
We add two IoT CVEs and discuss the other sorts of traffic we see regularly.
First reported Dec 19, 2023 11:32 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordREPORT1 SOURCE
The DNS Attacks We’re Still Seeing
F5 threat intelligence reports attackers are still doing DNS water torture DDoS, DNS reflection DDoS, expired domain takeover, and using DNS requests for covert channels.
First reported Dec 04, 2018 15:46 UTCCatalog metadata updated Oct 14, 2026 06:47 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.