Browse public community intelligence reports, source analysis, and threat research.
5 intel reports
Chinese threat actor UTA0565 utilized chained Chrome and Windows zero-day exploits through spoofed domains to deliver a custom obfuscated malware named CLEANGULP targeting government entities.
Chinese threat actors UTA0560 and JungleBamboo exploited a 'patch-gap' zero-day chain in Chrome and Windows to deploy the GRIMWEDGE backdoor and LONGTALE credential stealer.
The Kimsuky group is deploying a new multi-stage LNK malware campaign targeting South Korean financial sectors using GitHub, Dropbox, and WordPress as functional C2 channels.
Multiple espionage threat actors, including China-aligned TA412, are deploying the BlueMoon exploit kit to chain Chrome V8 RCE and Windows kernel LPE vulnerabilities for malware delivery.
State-aligned threat actors, primarily China-linked, are deploying the BlueMoon exploit kit to leverage Chrome and Windows zero-days for rapid espionage campaigns.
