Browse public community intelligence reports, source analysis, and threat research.
103 intel reports
JadeProx is a China-nexus threat cluster targeting Southeast Asia and Latin America using TriBack Loader and various tunneling tools for cyber espionage.
Attackers are impersonating Interactive Brokers using a tax-themed W-8BEN expiration lure and 0-day domains to harvest credentials from healthcare sector employees.
Tengu is an evolved Mirai-derived IoT botnet featuring AEAD-encrypted C2, proxy capabilities, and aggressive self-defense mechanisms targeting Linux and Android systems.
The JadeProx cluster, a China-nexus threat group, is using a custom 'TriBack Loader' to deliver AdaptixC2 and Beagle backdoors via DLL sideloading against targets in Southeast Asia and Latin America.
HOLLOWGRAPH malware utilizes Microsoft Graph API to abuse Microsoft 365 calendars as a command-and-control channel for tasking and exfiltration.
Attackers can abuse the legitimate Windows Bind Filter driver (bindflt.sys) to virtualize file paths, allowing malicious code to masquerade as trusted system files and blind EDR sensors.
Threat actors are increasingly using LLMs to generate bespoke, functional malware and automate complex Active Directory enumeration, data exfiltration, and extortion workflows.
ClickLock Dev uses ClickFix social engineering and aggressive process-killing loops to steal credentials and crypto wallets from macOS users in Europe and North America.
A China-linked actor is using the advanced Daxin kernel-mode rootkit alongside a novel Stupig backdoor to maintain decade-long persistence in a Taiwan manufacturing firm.
LabubaRAT is a newly discovered Rust-based remote access tool that uses NVIDIA-themed metadata and multiple communication channels, including DNS tunneling, to maintain persistence and control over infected Windows hosts.
