Browse public community intelligence reports, source analysis, and threat research.
102 intel reports
C2Looper is a new Rust-based backdoor likely linked to ransomware actors, utilizing GitHub for command-and-control and distributed via ClickFix campaigns.
A multi-stage PureLogs Stealer campaign impersonates Adobe Sign to deliver fileless payloads via image steganography and environment variable manipulation.
UNC5142 utilizes a Python-based RAT named DeviceManager, delivered via ClickFix campaigns, leveraging Ethereum smart contracts for resilient C2 infrastructure resolution and DNS for communication.
Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.
Gunra (also known as Golden Community) is a RaaS operation using a double-extortion model targeting critical infrastructure by exploiting vulnerabilities in Fortinet appliances and leveraging Impacket for lateral movement.
pyCodeV3 is a multi-stage Python loader using dynamic domain generation and pickle deserialization to execute arbitrary code from C2 servers.
Russian-linked DOUBLECUP Loader-as-a-Service facilitates ClickFix campaigns delivering CountLoader and a new blockchain-resolving RAT named DeviceManager.
An unidentified threat actor leveraged SQL injection on a Tomcat application to install a database-resident post-exploitation toolkit called khunt on an Oracle server.
A state-sponsored threat group and Gunra ransomware actors exploited vulnerabilities in South Korean financial security software like AnySign4PC to deploy SIGNBT and COPPERHEDGE backdoors via watering holes.
The Chaos ransomware group is using a new Rust-based RAT called msaRAT that establishes covert C2 channels by hijacking headless Chrome and Edge browsers via the Chrome DevTools Protocol.
