Browse public community intelligence reports, source analysis, and threat research.
103 intel reports
A suspected China-nexus actor, designated SilkParasite, utilizes a modular ecosystem of seven RAT families to target government economic bodies in Central Asia via DLL sideloading and Google Drive-backed C2.
Threat actors are abusing FTP banners as Dead Drop Resolvers (DDRs) to deliver novel RATs, E4del and PINHOLE, using legitimate services like Pinterest and SurveyMonkey for configuration retrieval.
The Offside Wallet Theft Factory campaign utilizes 77 malicious Firefox extensions to steal cryptocurrency secrets and credentials by masquerading as Web3 tools and sports-score utilities.
ACRStealer campaign leverages a legitimate, Microsoft-signed Korean DLP driver (DCRCVDrv.sys) to perform kernel-context process termination for security software suppression.
An attacker targeted hardware wallet users using a typosquatted Ledger domain laundered through an Australian venue's authenticated transactional email infrastructure.
Myxa VPN operates 737 malicious Chrome extensions impersonating 66 privacy brands to redirect all user browser traffic through controlled SOCKS5 proxies.
AISURU threat actors deployed Kimwolf v7 targeting Android TV boxes and IoT devices using Ethereum Name Service (ENS) for resilient C2 and advanced HTTP/2 DDoS fingerprinting.
Twill Typhoon leverages a supply chain compromise of the QuickFox VPN proxy to deliver the FDMTP implant through multi-stage loaders and execution guardrails.
A state-sponsored threat group and Gunra ransomware actors exploited vulnerabilities in South Korean financial security software like AnySign4PC to deploy SIGNBT and COPPERHEDGE backdoors via watering holes.
Threat actors are deploying the NetSupport Manager RAT through a multi-stage chain involving phishing PDFs and obfuscated JavaScript to disguise legitimate binaries in a 'Stereo' folder.
