Intel Exchange

TeamPCP uses the Miasma worm to compromise developers and CI/CD pipelines by hijacking AI coding agents and poisoning package registries.

LegionLoader uses a multi-stage infection chain involving MSI files, DLL sideloading, and Python-based components to achieve stealthy execution and C2 communication.

The Ethereum Loader is a sophisticated multi-stage malware that uses blockchain-based C2 communication and masquerades as VMware components to evade detection.

Phantom Stealer utilizes obfuscated VBScript droppers and .NET loaders with Telegram-based C2 infrastructure to exfiltrate browser credentials and system data.

A likely Iran-nexus activity cluster is deploying BLUERABBIT, a Golang-based backdoor that utilizes RabbitMQ, Redis, and MinIO for C2 and exfiltration prior to disk wiping and ransomware deployment.

Kimsuky APT utilizes a multi-stage JScript loader to deploy the NUKESPED backdoor, targeting South Korean entities through social engineering lures.

A threat actor operating as Leda Elacoate is conducting a supply chain campaign using trojanized installers for crypto-trading and VPN software to deploy the STX RAT infostealer via DLL sideloading.

The Vile Collective utilizes a Go-based ransomware that employs double extortion, HPKE-v1 encryption, and extensive anti-analysis techniques to target a wide range of global sectors.

The Miasma threat actor group has expanded its supply chain campaign with 23 new malicious PyPI packages targeting bioinformatics and AI developers through trojanized native extensions and split-payload loaders.

Latrodectus malware utilizes MSI installers and PowerShell droppers to establish persistence and C2 communication while masquerading as legitimate SentinelOne security software.