Browse public community intelligence reports, source analysis, and threat research.
63 intel reports
UNC6240 (ShinyHunters) is conducting mass exploitation of CVE-2026-35273 in Oracle PeopleSoft using WAF bypass techniques to deploy SIDEEYE backdoors and MeshCentral agents for extortion.
A suspected China-based threat actor exploited file upload vulnerabilities in a recreation management platform to deploy webshells and steal payment card data.
Sauron Loader is a novel Russian-language Malware-as-a-Service that utilizes social engineering, DLL side-loading, and in-memory decryption to deliver multi-stage payloads.
TASK#STOMP uses a VBScript-orchestrated execution chain to deploy a multi-stage PowerShell backdoor focused on automated document exfiltration, credential theft, and remote access.
VK Group’s Max messenger facilitates state-level surveillance by providing unencrypted message access, mandatory pre-installation, and granular behavioral tracking of Russian users.
Konni, a DPRK-nexus actor, is targeting Ukrainian entities using socio-economic lures to deploy VelvetCake, a modular PowerShell-based task runner and reconnaissance tool.
Transparent Tribe (APT-C-56) utilizes ISO/ZIP-based lure files and LNK execution chains to deploy CrimsonRAT and a custom Golang-based remote access trojan against Indian and South Asian targets.
BabylonRAT is an open-source Remote Access Trojan (RAT) capable of credential theft, keylogging, and DDoS attacks, recently used in campaigns targeting public institutions in Malaysia.
A self-proclaimed bug bounty hunter utilizes LLM-generated JavaScript malware named PhantomRaven to compromise developer environments via typosquatted npm packages for credential theft.
Op nKe y is a c o n f i g u r a b l e r a n s o m w a r e k i t u t i l i z i n g D i s c o r d w e b h o o k s f o r C2 c o m m u n i c a t i o n a n d m a s q u e r a d i n g a s l e g i t i m a t e W i n d o w s s e r v i c e s.
