Intel Exchange

SLEEPWALKER is a sophisticated passive DLL backdoor targeting ERAAgent.exe that utilizes a custom bytecode command language and sniffs network traffic for magic trigger packets rather than beaconing.

ClickFix campaign leverages pcalua.exe and WMI to mount remote WebDAV shares for executing infostealer DLLs via rundll32.exe.

Gunra is a sophisticated RaaS variant derived from Conti source code that utilizes Fortinet exploits and multi-threaded encryption to target global critical infrastructure.

Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.

Gunra (also known as Golden Community) is a RaaS operation using a double-extortion model targeting critical infrastructure by exploiting vulnerabilities in Fortinet appliances and leveraging Impacket for lateral movement.

UNC6692 uses email bombing and IT impersonation via Microsoft Teams to deploy the Edgecution/SNOW malware suite and facilitate ransomware access.

TOKYOCORE is a sophisticated C++ malware combining ransomware, data theft, and hardware-destructive wiper capabilities, attributed to the actor @meds.

The Qilin (aka Agenda) ransomware group is exploiting a critical Palo Alto Networks authentication bypass vulnerability (CVE-2026-0257) to gain initial access and deploy ransomware via credential-driven lateral movement.

An unknown threat actor deployed a new Rust-based ransomware called Spirals against a South Asian IT services company using web shell access and rapid lateral movement.

The threat actor Hyadina has rebranded Beast ransomware as GodDamn, utilizing the malicious PoisonX kernel driver to disable endpoint defenses via BYOVD attacks.