Browse public community intelligence reports, source analysis, and threat research.
42 intel reports
SystemBC is a Windows-based malware family used as a SOCKS5 proxy and persistent RAT by major ransomware groups to tunnel malicious traffic and execute payloads.
The Drun Backdoor is a modular two-stage infostealer that utilizes the Chromelevator loader to inject into processes via direct syscalls, targeting browser credentials, session tokens, and gaming accounts.
A sophisticated multi-stage batch dropper uses PowerShell and VBScript to execute obfuscated payloads, perform DLL hijacking, and establish redundant C2 communications.
The suspected Muddywater (APT28 variant) actor is deploying the Moodleuni C2 RAT using a fake Inno Setup installer to establish persistence via COM registration and startup shortcuts.
LegionLoader uses a multi-stage infection chain involving MSI files, DLL sideloading, and Python-based components to achieve stealthy execution and C2 communication.
The Reynolds ransomware group utilizes the NSecKrnl kernel driver to terminate EDR processes and employs double-extortion tactics against enterprise targets.
Kimsuky APT utilizes a multi-stage JScript loader to deploy the NUKESPED backdoor, targeting South Korean entities through social engineering lures.
Latrodectus malware utilizes MSI installers and PowerShell droppers to establish persistence and C2 communication while masquerading as legitimate SentinelOne security software.
The Sauron ransomware operation utilizes a multi-stage toolkit, including Telegram Bot API for data exfiltration and professional-grade system profiling for double extortion.
Russia's FSB-operated Gamaredon group leverages a modular VBScript and PowerShell arsenal targeting Ukraine through advanced persistence and multi-stage loading techniques.
