Browse public community intelligence reports, source analysis, and threat research.
103 intel reports
The TuxBot v3 Evolution framework is a modular IoT botnet targeting multiple architectures using LLM-assisted code generation and diverse C2 fallback mechanisms.
An unprivileged user can exploit a logic flaw in the Windows Installer service to delete arbitrary folders as SYSTEM and subsequently execute code by planting malicious rollback scripts.
CrashStealer is a native C++ macOS information stealer that impersonates Apple crash-reporting tools and uses notarized droppers to harvest credentials, keychain data, and crypto wallets.
A logistics-themed spear-phishing campaign deploys CrySome RAT via a multi-stage chain involving UAC bypass, AMSI patching, and the WinDefCtl utility to disable endpoint defenses.
The threat actor Nightmare Eclipse released the RoguePlanet zero-day exploit (CVE-2026-50656) targeting a race condition in Microsoft Defender to achieve SYSTEM privileges on Windows 10 and 11.
PamStealer is a macOS infostealer that validates captured credentials using the PAM API and uses a two-stage JXA/Rust delivery chain to evade detection.
China-nexus threat actors are exploiting public-facing phpMyAdmin panels via log poisoning to deploy Nezha monitoring agents and Ghost RAT malware.
Turla (Secret Blizzard) targets government and military entities globally using the custom STOCKSTAY and Kazuar backdoors, often leveraging hijacked infrastructure.
Trojan FIXMAPI Loader is a reconnaissance stager delivered via trojanized Advanced Installer packages that impersonates Microsoft components to profile victims and beacon to C2 infrastructure.
The Millenium RAT has evolved into a native C++ application used by Y2K Operators to compromise over 62,000 global targets via Telegram-based command and control.
