Browse public community intelligence reports, source analysis, and threat research.
7 intel reports
Konni, a DPRK-nexus actor, is targeting Ukrainian entities using socio-economic lures to deploy VelvetCake, a modular PowerShell-based task runner and reconnaissance tool.
A Ukrainian-themed phishing campaign utilizes a multi-stage VBScript dropper to download decoy documents and execute payloads from external file-hosting infrastructure.
Transparent Tribe (APT-C-56) utilizes ISO/ZIP-based lure files and LNK execution chains to deploy CrimsonRAT and a custom Golang-based remote access trojan against Indian and South Asian targets.
Russia-aligned threat group UAC-0099 is delivering a multi-stage infection chain involving LUNCHPOKE, BURNYBEAR, and MATCHBOIL.V2 by abusing legitimate Notepad++ plugin loading routines.
Stealth Falcon utilized an LLM-accelerated WebDAV delivery lab to deploy PureRAT via working directory hijacking and DLL sideloading targeting Mexican enterprise users.
The Veil#Drop framework utilizes a multi-stage infection chain involving JavaScript launchers and PowerShell cradles hosted on Blogspot to deploy PureLog Stealer in memory.
IRGC-affiliated actor Nimbus Manticore deployed the new MiniFast backdoor using AppDomain hijacking and SEO poisoning to target both aviation and software sectors during geopolitical conflict.
