Browse public community intelligence reports, source analysis, and threat research.
44 intel reports
Russian-speaking threat actor UAT-11795 is utilizing ClickFix lures and trojanized software to deploy novel Python-based Starland RAT and PowerShell-based WLDR agent for cryptocurrency theft.
China-nexus threat actors are exploiting public-facing phpMyAdmin panels via log poisoning to deploy Nezha monitoring agents and Ghost RAT malware.
The Millenium RAT has evolved into a native C++ application used by Y2K Operators to compromise over 62,000 global targets via Telegram-based command and control.
The Shai-Hulud worm and GitRunner C2 framework abuse legitimate, digitally signed GitLab CI runner binaries as persistent backdoors to execute commands via CI/CD pipelines.
An unidentified threat actor is targeting Thailand's healthcare sector using healthcare-themed lures to deploy a Python-based information stealer via multi-stage batch scripts.
An attacker compromised the CDN API keys of OptinMonster, TrustPulse, and PushEngage to serve tampered JavaScript that creates rogue admin accounts on customer sites.
DirtyFrag is a sophisticated Linux kernel Local Privilege Escalation toolkit that uses page cache corruption and RxRPC/AF_ALG abuse to gain root access.
UNC5221 utilizes the SNOWLIGHT dropper to deploy VSHELL RAT, employing sophisticated evasion like direct syscalls and AMSI patching to compromise Windows systems.
APT37 utilizes obfuscated LNK files and multi-stage batch scripts to deploy a Python-based remote access backdoor disguised as a .cat file.
The PhantomRaven actor is targeting DeFi, Cloud, and AI developers via 33 malicious NPM packages using a multi-stage Remote Dynamic Dependency chain to harvest credentials.
