Browse public community intelligence reports, source analysis, and threat research.
219 intel reports
Suspected Silver Fox (Yinhu) threat actors are targeting Chinese-speaking users and multinational operations in China using high-fidelity spoofed vendor sites to deliver persistent implants like ValleyRAT.
The CL-CRI-1171 threat actor operates a mature Pay-Per-Install (PPI) marketplace that leverages SEO poisoning and trojanized YouTube gaming content to distribute OfferLoader and a variety of secondary payloads including Insomnia RAT and ARKTunnel.
The threat actor zdn2pwn utilizes XHOPELESS v1.0, a sophisticated multi-phase wiper designed to permanently brick Windows systems by corrupting UEFI firmware, destroying disk partitions, and disabling all recovery mechanisms.
A suspected Chinese-speaking threat actor is targeting systems in South Korea to install remote control and proxy tools, including Radmin, UltraVNC, and SoftEther VPN, to weaponize infected hosts as proxy nodes.
Russian-linked threat actor UAT-10820 utilizes ClearFake infection chains and WebDAV-hosted DLLs to deploy Amatera stealer and follow-on payloads like ZigCryptoStealer and NetSupport Manager.
SilkParasite is a China-nexus cyberespionage cluster targeting Central Asian government entities using a modular arsenal of seven RAT families, including five previously undocumented tools and AI-assisted tradecraft.
APT28 and MuddyWater utilize ClickFix variants to compromise organizations via social engineering, deploying multi-stage payloads including steganography and Python-based reverse tunnels for internal network pivoting.
Threat actors are leveraging compromised WordPress sites and blockchain smart contracts to deliver Amatera password stealers and WebRTC stagers through ClickFix lures.
Gamaredon, a Russian FSB-operated group, uses a multi-stage modular framework (GammaPhish, GammaLoad, GammaWorm, GammaSteel) to maintain persistent access and exfiltrate sensitive documents from Ukrainian government and critical infrastructure.
The Armadin Attacker uses a new tool called PRTremote to hijack Entra ID Primary Refresh Tokens by executing scheduled tasks within interactive user sessions over SMB.
