Browse public community intelligence reports, source analysis, and threat research.
281 intel reports
Silver Fox threat group utilizes tax-themed phishing to deploy a modified RustSL loader, ValleyRAT, and a new Python-based backdoor named ABCDoor against organizations in Russia and India.
BlueNoroff is targeting Web3 and cryptocurrency executives using AI-generated deepfake meetings and ClickFix clipboard injection to deploy credential stealers.
The Kyber ransomware group deploys specialized dual-platform payloads targeting VMware ESXi infrastructure and Windows file systems, utilizing hybrid encryption and extensive anti-recovery techniques.
The Gentlemen RaaS employs a multi-platform locker suite targeting Windows, Linux, and ESXi environments, utilizing SystemBC and Cobalt Strike for lateral movement and persistence.
Threat actors compromised the Axios npm package to deliver a multi-platform Remote Access Trojan (RAT) via the malicious dependency 'plain-crypto-js'.
The PowMix botnet targets Czech organizations using compliance-themed phishing lures and sophisticated PowerShell-based in-memory execution.
Threat actors compromised the axios npm package to deliver a multi-stage, cross-platform Remote Access Trojan (RAT) via a malicious dependency named plain-crypto-js.
An attacker uses a multi-stage fileless infection chain involving obfuscated VBScript and in-memory .NET loaders to deploy ScreenConnect for persistent remote access.
The Iranian threat actor MuddyWater (MOIS) is leveraging Russian-speaking TAG-150's CastleRAT and ChainShell malware platforms to target Israeli infrastructure and aerospace sectors.
ClipBanker malware utilizes a complex, multi-stage infection chain starting from trojanized software on GitHub to swap cryptocurrency wallet addresses via clipboard monitoring.
