Browse public community intelligence reports, source analysis, and threat research.
10 intel reports
GhostFrame is an ESXi post-exploitation framework that Recorded Future observed in TAG-218 activity overlapping with Settra ransomware operations.
The suspected PRC-nexus actor ARMORY CASTLE exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to deploy custom SAWFLY webshells and BARECLAW tunnelers for credential theft and lateral movement.
Qilin (aka Agenda) is a high-volume Russian-speaking RaaS operation targeting global manufacturing and healthcare sectors through credential abuse and advanced EDR evasion.
The Cling botnet exploits multiple IoT vulnerabilities to deploy a worm-like malware that repurposes legitimate STUN traffic and infrastructure for command-and-control communications.
Adversaries are deploying modular Linux implants including BPFDoor, Rekoobe, and the new AVERAT RAT against telecom edge appliances, utilizing SMTP-disguised C2 and BPF packet filtering to evade detection.
Gamaredon, a Russian FSB-operated group, uses a multi-stage modular framework (GammaPhish, GammaLoad, GammaWorm, GammaSteel) to maintain persistent access and exfiltrate sensitive documents from Ukrainian government and critical infrastructure.
The Evooo1Bot and GorillaBot threat actors are deploying highly modular Mirai-based malware targeting Linux systems and IoT devices to execute large-scale DDoS attacks and establish persistent proxy relays.
INC Ransomware and threat actor UTA0533 are weaponizing a zero-day exploit chain in SonicWall SMA 1000 series appliances to achieve root access and deploy memory-resident malware.
The Silver Fox group is targeting Japanese industrial manufacturing organizations using a modular three-driver BYOVD framework to deploy ValleyRAT for persistent remote access.
A threat actor compromised a Mastra maintainer account to poison 140+ npm packages with a malicious dependency used for cross-platform backdoors and credential exfiltration.
