Browse public community intelligence reports, source analysis, and threat research.
124 intel reports
Konni, a DPRK-nexus actor, is targeting Ukrainian entities using socio-economic lures to deploy VelvetCake, a modular PowerShell-based task runner and reconnaissance tool.
An unauthenticated visitor can exploit a flaw in the wpautop() function of WordPress core to plant a stored XSS payload that escalates to RCE when viewed by an administrator.
MovieReaper uses compromised torrent repositories and the Solana blockchain to deploy a multi-stage modular framework targeting diverse global sectors.
GhostCode is a novel phishing kit that abuses the Microsoft Device Code authorization flow to bypass MFA and achieve persistent access to M365 environments.
Threat actors are chaining three JFrog Artifactory vulnerabilities to bypass authentication, escalate privileges to administrator, and deploy Rust-based backdoors.
BabylonRAT is an open-source Remote Access Trojan (RAT) capable of credential theft, keylogging, and DDoS attacks, recently used in campaigns targeting public institutions in Malaysia.
The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.
The Shai-Hulud worm payload has resurfaced on the npm registry via four new packages after 111 days of dormancy following the initial @AntV compromise.
ExfilSquad is a data extortion group targeting organizations by exploiting misconfigured Microsoft Power Pages portals to exfiltrate Dataverse records via public APIs.
Threat actors known as PasteSwitch compromised the official HBO Max Reddit account to deploy ClickFix social engineering attacks, delivering macOS and Windows infostealers.
