Browse public community intelligence reports, source analysis, and threat research.
91 intel reports
Iranian-affiliated APT actors are targeting internet-exposed PLCs from Rockwell, Schneider, and Siemens to disrupt U.S. critical infrastructure via project file manipulation.
TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.
DPRK-aligned threat actors are targeting developers with fake coding interviews that deliver OTTERCOOKIE malware via SVG-based steganography.
The popular ModHeader browser extension was discovered containing a dormant but fully functional pipeline for collecting, encrypting, and exfiltrating user browsing history.
Russian-speaking threat actors are exploiting CVE-2026-35616 in FortiClient EMS to deploy EKZ Stealer and FortigateSniffer, facilitating credential harvesting and subsequent ransomware attacks by INC Ransom and Lynx.
The Veil#Drop framework utilizes a multi-stage infection chain involving JavaScript launchers and PowerShell cradles hosted on Blogspot to deploy PureLog Stealer in memory.
Turla (Secret Blizzard) targets government and military entities globally using the custom STOCKSTAY and Kazuar backdoors, often leveraging hijacked infrastructure.
Trojan FIXMAPI Loader is a reconnaissance stager delivered via trojanized Advanced Installer packages that impersonates Microsoft components to profile victims and beacon to C2 infrastructure.
UNC1549, an Iranian-linked APT, targets global aerospace and defense sectors using fake career portals to deliver custom malware including MiniJunk and MiniBrowse.
Kimsuky (APT43) utilizes a multi-stage CHM-based execution chain to profile systems and selectively deliver follow-on PowerShell payloads to targeted hosts.
