Browse public community intelligence reports, source analysis, and threat research.
53 intel reports
Threat actors can abuse Windows Quality of Service (QoS) policies via PowerShell or WMI to throttle EDR agent outbound bandwidth to near zero, effectively silencing cloud-based telemetry.
Threat actors are utilizing VHDX disk images to deliver Remcos RAT through a multi-stage process involving WMI execution and reflective .NET loading to bypass security controls.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
The EDRChoker tool abuses Windows Policy-Based Quality of Service (QoS) to starve security agents of bandwidth, causing them to silently time out without generating network block artifacts.
LCRYX is a multifunctional VBS-based ransomware and worm that performs extensive registry tampering, security software termination, and network-wide self-propagation.
Microsoft Defender now utilizes Windows Filtering Platform (WFP) integration to monitor inbound remote RPC calls at the OpNum level to detect lateral movement, credential theft, and discovery.
An unknown threat actor is using JavaScript and PowerShell to deliver .NET malware hidden via steganography in MSI-branded JPEG images hosted on legit services.
DarkWatchman is a sophisticated, fileless JavaScript-based RAT that uses C# keyloggers and registry-based persistence to evade detection.
The GreenBlood ransomware group utilizes a Go-based malware featuring military-grade encryption and double extortion tactics to target global organizations.
China-nexus threat group UAT-8302 targets government entities in South America and southeastern Europe using a suite of shared and custom malware including NetDraft, CloudSorcerer, and VSHELL.
