Browse public community intelligence reports, source analysis, and threat research.
53 intel reports
Threat actors use Microsoft Teams social engineering and Quick Assist to deploy a two-component relay and reverse shell via DLL sideloading and WMI execution.
ClickFix campaign leverages pcalua.exe and WMI to mount remote WebDAV shares for executing infostealer DLLs via rundll32.exe.
Gunra is a sophisticated RaaS variant derived from Conti source code that utilizes Fortinet exploits and multi-threaded encryption to target global critical infrastructure.
A suspected China-nexus actor, designated SilkParasite, utilizes a modular ecosystem of seven RAT families to target government economic bodies in Central Asia via DLL sideloading and Google Drive-backed C2.
Threat actors are abusing FTP banners as Dead Drop Resolvers (DDRs) to deliver novel RATs, E4del and PINHOLE, using legitimate services like Pinterest and SurveyMonkey for configuration retrieval.
The StopAndProtect operation abuses compromised WordPress sites to distribute a multi-component toolkit for file encryption, data theft, and lateral movement via social engineering.
Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.
Gunra (also known as Golden Community) is a RaaS operation using a double-extortion model targeting critical infrastructure by exploiting vulnerabilities in Fortinet appliances and leveraging Impacket for lateral movement.
Adversaries are leveraging NTFS Alternate Data Streams (ADS) to execute malware, which causes Windows to store Prefetch artifacts within secondary streams, effectively hiding execution evidence from standard forensic tools. https://attack.mitre.org/techniques/T1564/004/
Russian-linked DOUBLECUP Loader-as-a-Service facilitates ClickFix campaigns delivering CountLoader and a new blockchain-resolving RAT named DeviceManager.
