Browse public community intelligence reports, source analysis, and threat research.
281 intel reports
The ROOTBOY actor is deploying Prinz Eugen, a technically deliberate Go-based ransomware that prioritizes fresh data and utilizes anti-forensics to evade detection.
The ErrTraffic Malware-as-a-Service framework uses the ClickFix social engineering tactic and EtherHiding blockchain dead-drop resolvers to distribute infostealers and loaders through compromised WordPress sites and fake AI platforms.
Dropping Elephant is using a China-themed decoy document to deliver a heavily reworked, in-memory RAT via DLL side-loading and Donut shellcode.
Financially motivated actors like Vanilla Tempest are leveraging ClickFix social engineering to deliver modular loaders including BabaDeda, Lorem Ipsum, and Potemkin, ultimately deploying ransomware like Rhysida.
The APT37 group is targeting South Korean users with NarwhalRAT, a multi-stage Python backdoor delivered via Microsoft-themed phishing and utilizing pCloud as a dead-drop resolver.
Threat actors can abuse Windows Quality of Service (QoS) policies via PowerShell or WMI to throttle EDR agent outbound bandwidth to near zero, effectively silencing cloud-based telemetry.
Threat actors are utilizing VHDX disk images to deliver Remcos RAT through a multi-stage process involving WMI execution and reflective .NET loading to bypass security controls.
Attackers leverage the Windows Distributed Component Object Model (DCOM) to execute remote commands via trusted binaries like mmc.exe and excel.exe.
The Phantom Stealer campaign targets banks and high-value organizations using fileless techniques and a layered dropper to exfiltrate browser credentials and financial data.
EtherRAT uses the Ethereum blockchain for resilient C2 infrastructure while distributing via malicious MSI and PowerShell loaders.
