Browse public community intelligence reports, source analysis, and threat research.
22 intel reports
Storm-2603 exploited CVE-2025-53770 and CVE-2025-53771 in Microsoft SharePoint to deploy a fileless in-memory webshell for ransomware delivery and lateral movement.
The Vectra (formerly Nyxel) actor operates VectraRAT, a custom Go and C++ Malware-as-a-Service platform delivered via Amadey and ClickFix campaigns targeting corporate Windows environments.
DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.
Gunra is a sophisticated RaaS variant derived from Conti source code that utilizes Fortinet exploits and multi-threaded encryption to target global critical infrastructure.
SynkLoader is a modular Windows malware family distributed via Microsoft Teams phishing that uses a bundled Python environment and in-memory components to facilitate credential theft, tunneling, and remote access.
China-aligned threat actor ITG27 (Mustang Panda) is targeting the Indian government and energy sector using updated Toneshell v10 and a new VNC-capable backdoor named Havencode.
The ServiceNow Red Team developed Dark, an open-source Mythic C2 agent written in Crystal that features in-memory Beacon Object File (BOF) execution for macOS and Linux.
The North Korean threat actor Andariel (APT45) conducts a blend of strategic cyber espionage and financially motivated ransomware attacks targeting defense, aerospace, nuclear, and healthcare sectors.
Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.
Gunra (also known as Golden Community) is a RaaS operation using a double-extortion model targeting critical infrastructure by exploiting vulnerabilities in Fortinet appliances and leveraging Impacket for lateral movement.
