Browse public community intelligence reports, source analysis, and threat research.
91 intel reports
The Shai-Hulud worm compromised the tensorlake npm package to steal developer credentials, AI tool configurations, and implement a self-destruct mechanism triggered by token revocation.
The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.
DPRK-linked actors are utilizing ErrTraffic ClickFix lures on compromised WordPress sites alongside fake recruiter personas to deliver Node.js-based RATs with Polygon-hosted C2 resolvers.
The bonto.io campaign uses malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys.
CrocoRat is a Python-based remote access trojan and cryptocurrency stealer delivered via ClickFix social engineering and novel DNS TXT record payload staging.
Earth Sirrush (UAC-0099) utilizes evolving .NET malware, steganographic delivery, and trojanized applications to target Ukrainian government and logistics sectors for long-term espionage.
The Cl0p extortion operation has pivoted from traditional encryption-based ransomware to large-scale data theft via the exploitation of internet-facing Managed File Transfer (MFT) and enterprise software.
The Brazilian threat actor Exilware utilizes the BraZetsu framework and Hestia Control Panel infrastructure to operate an initial access marketplace targeting Latin American organizations.
The P7 variant of DarkSword targets iOS 18.x devices using chained vulnerabilities to exfiltrate keychain data, cryptocurrency wallets, and Apple Notes via a sophisticated two-way C2 architecture.
Russian state actor Star Blizzard is conducting large-scale phishing campaigns against Ukraine-aligned organizations using a novel malware delivery technique called RedFlick to deploy the CosmicPulse backdoor.
