Browse public community intelligence reports, source analysis, and threat research.
67 intel reports
Cluster c05d5254 utilizes the PoisonedRefresh rootkit to inject fileless PHP web shells into F5 BIG-IP APM memory via CVE-2025-53521 exploitation.
RedTail is a multi-architecture Linux malware that utilizes process masquerading, DNS-over-TLS for C2, and aggressive termination of analysis tools to maintain persistence and evade detection.
REVSTEALER is a comprehensive Windows infostealer using Polygon smart contracts for resilient C2 infrastructure and delivering specialized modules for crypto-mining and reverse proxying.
DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.
Threat actors are leveraging compromised WordPress sites and blockchain smart contracts to deliver Amatera password stealers and WebRTC stagers through ClickFix lures.
Lazarus Group is targeting macOS users with trojanized application installers that deliver the OtterCookie RAT through a multi-stage infection chain.
A Russian-speaking operator compromised over 14,000 Dahua IP cameras globally, primarily in Ukraine and Russia, using authentication bypasses, P2P relay abuse, and credential brute-forcing.
TWINLOOT is a modular Python implant using Microsoft SharePoint, Teams, and headless Edge browsers for stealthy command-and-control and lateral movement.
The BRIDGEHEAD campaign utilizes 40 npm typosquatting packages to jump from WSL environments to Windows hosts, deploying a Rust-based stealer for cryptocurrency wallets and browser credentials.
Blackpoint APG identified Miraak, a modular post-exploitation framework using PostgreSQL/Timescale for C2 communication and featuring Cobalt Strike BOF compatibility.
