Intel Exchange

Canis C2 is a previously undocumented cross-platform surveillance framework targeting Japanese users with sophisticated mobile agents and OS-specific fingerprinting.

APT29 utilizes a multi-stage execution chain involving screensaver droppers, steganography-embedded payloads, and extensive memory manipulation to harvest credentials and move laterally.

The threat actor UAT-10362 is targeting Taiwanese NGOs and universities with a modular Lua-based stager called LucidRook and a reconnaissance tool named LucidKnight.

DPRK-linked threat actors are targeting South Korean organizations using LNK files that execute multi-stage PowerShell scripts and abuse GitHub as a command-and-control infrastructure.

North Korean actor Sapphire Sleet compromised the popular Axios npm package to deliver platform-specific RATs via a malicious dependency named plain-crypto-js.

The Kimsuky threat group is distributing complex Python-based backdoors and downloaders via multi-stage LNK files using scheduled tasks for persistence.

A vulnerability chain in Azure Arc for Windows allows low-privileged users to hijack service communications, escalate to SYSTEM and take over the machine's Azure cloud identity.

North Korean threat actor NICKEL ALLEY is targeting tech professionals via fake job interviews to deliver PyLangGhost RAT and BeaverTail malware through social engineering and malicious GitHub repositories.

A widespread initial access campaign using fraudulent human-verification prompts to trick victims into executing malicious commands via native system tools.

Threat actors are leveraging Windows Toast Notifications and Application User Model IDs to spoof trusted system alerts for credential theft and malicious URL redirection.