Browse public community intelligence reports, source analysis, and threat research.
145 intel reports
Kimsuky (APT43) utilizes a multi-stage CHM-based execution chain to profile systems and selectively deliver follow-on PowerShell payloads to targeted hosts.
The Millenium RAT has evolved into a native C++ application used by Y2K Operators to compromise over 62,000 global targets via Telegram-based command and control.
The ChocoPoC threat actor is targeting security researchers with trojanized GitHub PoC repositories that install malicious PyPI packages to deliver a Python-based RAT.
Remcos RAT is a sophisticated Windows remote access trojan used by actors like APT33 and UAC-0050 for extensive surveillance, credential theft, and full system control.
A widespread campaign uses typosquatted software sites and SEO poisoning to distribute ScreenConnect, which then drops AsyncRAT onto target systems.
Threat actors are exploiting CVE-2026-48558 in SimpleHelp RMM software to deploy TaskWeaver and Djinn Stealer, targeting cloud, AI, and developer credentials across Windows, macOS, and Linux.
Threat actors are exploiting CVE-2026-48558 in SimpleHelp RMM to deploy TaskWeaver, a modular Node.js loader, and Djinn Stealer, a cross-platform information stealer targeting developer and AI credentials.
The Shai-Hulud worm and GitRunner C2 framework abuse legitimate, digitally signed GitLab CI runner binaries as persistent backdoors to execute commands via CI/CD pipelines.
The ToddyCat APT group utilizes Umbrij malware to compromise corporate Gmail accounts by leveraging a technique called Shadow Token via Remote Debug (STRD) to steal OAuth tokens.
Threat actors are exploiting an unauthenticated remote code execution vulnerability in Langflow (CVE-2026-33017) to deploy a multi-stage Monero cryptomining toolchain and spread via SSH key reuse.
