Browse public community intelligence reports, source analysis, and threat research.
37 intel reports
A fake-download campaign uses trojanized Inno Setup installers to deliver various monetization payloads, including proxyware and distributed-computing agents, to compromised Windows devices.
A 3AM ransomware affiliate targeted a UK school estate using a hybrid operation where a human operator guided an agentic AI loop to execute repetitive lateral movement and domain trust configuration tasks.
The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
Qilin (aka Agenda) is a high-volume Russian-speaking RaaS operation targeting global manufacturing and healthcare sectors through credential abuse and advanced EDR evasion.
Attackers deploy Remcos as a remote access tool to maintain persistent control, execute commands, and steal data from Windows systems.
Russia-aligned threat actor UAC-0099 has evolved its custom MATCHBOIL downloader with enhanced obfuscation, sandbox evasion, and timer-based payload delivery targeting Ukrainian sectors.
RATHat is an advanced Android banking trojan that abuses wireless debugging for shell access and utilizes Gemini LLM models for automated UI interaction and victim financial scoring.
