Browse public community intelligence reports, source analysis, and threat research.
91 intel reports
An unidentified attacker utilized MSSQL's xp_cmdshell for command execution and data exfiltration via Base64-encoded chunks during an intrusion involving Viva Aerobus-linked infrastructure.
Sauron Loader is a novel Russian-language Malware-as-a-Service that utilizes social engineering, DLL side-loading, and in-memory decryption to deliver multi-stage payloads.
TASK#STOMP uses a VBScript-orchestrated execution chain to deploy a multi-stage PowerShell backdoor focused on automated document exfiltration, credential theft, and remote access.
The MikroTrick exploit chain combines an SSH state-machine flaw with a login argument injection bug to achieve unauthenticated administrative control over MikroTik RouterOS devices.
The Rapuncel infostealer is distributed via SEO-optimized fake GitHub organizations, utilizing a Microsoft-signed kernel driver to disable security software.
Mini Shai-Hulud threat actors exploited re-enabled GitHub Actions repositories to resume credential harvesting via compromised mutable tags.
Unknown actors compromised MemTensor packages on npm and PyPI to deliver 'sckit', a Go-based worm designed for credential harvesting and self-propagation via CI/CD pipelines.
Iranian state cyber actors are using CHOSEN BRICK, a Windows-based spyware, to monitor dissidents and activists through social engineering and Telegram-based command and control.
Konni, a DPRK-nexus actor, is targeting Ukrainian entities using socio-economic lures to deploy VelvetCake, a modular PowerShell-based task runner and reconnaissance tool.
Kimsuky (APT-C-55) utilizes multi-stage PowerShell and C# malware delivered via disguised installers to target South Korean institutions for intelligence theft.
