Browse public community intelligence reports, source analysis, and threat research.
65 intel reports
A self-proclaimed bug bounty hunter utilizes LLM-generated JavaScript malware named PhantomRaven to compromise developer environments via typosquatted npm packages for credential theft.
Op nKe y is a c o n f i g u r a b l e r a n s o m w a r e k i t u t i l i z i n g D i s c o r d w e b h o o k s f o r C2 c o m m u n i c a t i o n a n d m a s q u e r a d i n g a s l e g i t i m a t e W i n d o w s s e r v i c e s.
An unsigned GlobalProtect-themed MSI deploys a backdoor that utilizes Cloudflare Workers for configuration and Google Sheets for C2 communication, specifically targeting victims in Myanmar.
KATARU is a newly observed IoT malware family that utilizes Linux local privilege escalation exploits and encrypted C2 to conduct DDoS attacks.
Kimsuky leverages AI agents like opencode and HeadlessChrome to mass-produce decoy documents while evolving its GitHub-based LNK execution framework with enhanced evasion and persistence.
Russian-speaking threat actors are exploiting a heap-based buffer overflow (CVE-2025-25249) in FortiGate devices to deploy PivotC2, an AI-assisted Node.js RAT for network tunneling and credential theft.
DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.
Tengu is a Linux-based botnet targeting IoT and server environments, utilizing kernel-worker masquerading and multiple persistence mechanisms to facilitate DDoS attacks.
Toy Ghouls (Bearlyfy) is using new custom backdoors, mqtt-bird-agent and matrix-bird-agent, targeting Russian organizations via HiveMQ and Element C2 channels.
ToxNetV2 is an AArch64 Linux P2P botnet that integrates NVIDIA NIM LLM services into its controller's decision-making loop to propose operational actions.
