Browse public community intelligence reports, source analysis, and threat research.
108 intel reports
Russian state actor Star Blizzard is conducting large-scale phishing campaigns against Ukraine-aligned organizations using a novel malware delivery technique called RedFlick to deploy the CosmicPulse backdoor.
Suspected Star Blizzard threat actors target Moldovan and Ukrainian civil society using the RedFlick technique, involving conversation-based phishing and VHDX-delivered malware.
Unattributed threat actors are leveraging legitimate MSP360 RMM and ConnectWise ScreenConnect installers via phishing to establish persistent remote access and deploy post-compromise tools.
AgtaBackup RAT uses deceptive Microsoft Store pages to deploy legitimate RMM tools as a bridge for a custom .NET backdoor targeting Windows systems.
SilverFox actors are targeting Malaysian users via WhatsApp lures that deliver ValleyRAT using DLL side-loading of a signed KuGou Technology executable.
The CARBONATO botnet exploits unauthenticated Docker daemons to deploy an AI-driven Hermes Agent for automated post-exploitation and credential harvesting via Telegram.
The MacSync family has evolved from AppleScript-based AMOS variants into a complex multi-stage binary infection chain targeting macOS users and developers to steal crypto and credentials.
A North Korean-linked operation targeted the npm registry using the GHAPPIER loader to establish persistence and remote access via compromised developer credentials.
The Iranian Ministry of Intelligence and Security (MOIS) uses HEAVYGRAM (aka CHOSEN BRICK) malware to target dissidents and journalists via social engineering and Telegram-based command-and-control.
Konni, a DPRK-nexus actor, is targeting Ukrainian entities using socio-economic lures to deploy VelvetCake, a modular PowerShell-based task runner and reconnaissance tool.
