Browse public community intelligence reports, source analysis, and threat research.
93 intel reports
A suspected Chinese threat actor is using SEO poisoning targeting DeepSeek AI users to deliver Kong RAT through a complex multi-stage infection chain.
DPRK-linked actors are utilizing ErrTraffic ClickFix lures on compromised WordPress sites alongside fake recruiter personas to deliver Node.js-based RATs with Polygon-hosted C2 resolvers.
An extensive phishing campaign impersonating the U.S. District Court targets over 100,000 companies using personalized lures to deliver the LodaRAT remote access trojan via malicious ISO files.
An SEO poisoning campaign utilizes fake Chocolatey and Microsoft Activation Scripts websites to deliver Armorsteal, a modular Python-based stealer and remote access tool.
KGB RAT is a Windows-based Malware-as-a-Service (MaaS) tool providing Remote Access Trojan capabilities, including credential theft, HVNC, ransomware, and cryptocurrency wallet swapping.
Midnight Blizzard-linked actor GTG-20006 utilized AI-assisted code generation to modify PowerShell stagers and Go backdoors targeting government and defense organizations via device-code phishing.
Mustang Panda and other Chinese APTs utilize the PlugX RAT for espionage and credential theft, leveraging DLL side-loading and USB propagation.
Agent Tesla is a .NET-based spyware Trojan that steals credentials, keystrokes, and screenshots primarily through malicious email attachments.
The MALFEX operator has conducted a two-year npm supply-chain campaign, deploying Overlord RAT and the movinlike stealer via multi-arm delivery packages, some of which remain active despite partial registry seizures.
China-based threat actors are deploying RatHat, a sophisticated Android Trojan that leverages generative AI for UI automation and ADB self-pairing for persistent shell access.
