Browse public community intelligence reports, source analysis, and threat research.
5 intel reports
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
Earth Sirrush (UAC-0099) utilizes evolving .NET malware, steganographic delivery, and trojanized applications to target Ukrainian government and logistics sectors for long-term espionage.
Water Hydra (EvilNum) has transitioned from complex zero-day exploits to social engineering-driven campaigns using .PIF files and non-standard protocol handlers to deliver the DarkMe RAT.
Konni, a DPRK-nexus actor, is targeting Ukrainian entities using socio-economic lures to deploy VelvetCake, a modular PowerShell-based task runner and reconnaissance tool.
The Belarus-aligned actor FrostyNeighbor is targeting Ukrainian governmental organizations using updated PicassoLoader variants and victim-validated delivery chains.
