Browse public community intelligence reports, source analysis, and threat research.
102 intel reports
TAG-195 (Golden Chickens) has introduced a new generation of modular malware, including TinyEgg and ChonkyChicken, featuring enhanced browser credential theft and session automation via CDP.
The NoEscape wiper is a destructive 'troll' malware that locks user interfaces, hijacks executable associations, and performs raw disk writes to disable systems.
LabubaRAT is a newly discovered Rust-based remote access tool that uses NVIDIA-themed metadata and multiple communication channels, including DNS tunneling, to maintain persistence and control over infected Windows hosts.
Salat Stealer, a Go-based information stealer, is distributed via gaming utilities like Xeno Executor to harvest credentials, crypto wallets, and perform live surveillance.
A sophisticated VBScript-based Java malware loader delivers Quima RAT by leveraging native Windows utilities for payload extraction and automated JRE installation.
Detection opportunities and rules for TAG-182's MarkiRAT campaign, covering fake VPN/media-player lures, BITS job abuse, svehost.exe masquerading, and typosquatted C2 infrastructure impersonating maj…
Threat actors are using vishing and Microsoft Teams screen-sharing to impersonate corporate IT support and deploy the blockchain-anchored EtherRAT malware.
Trojan FIXMAPI Loader is a reconnaissance stager delivered via trojanized Advanced Installer packages that impersonates Microsoft components to profile victims and beacon to C2 infrastructure.
UNC1549, an Iranian-linked APT, targets global aerospace and defense sectors using fake career portals to deliver custom malware including MiniJunk and MiniBrowse.
The Millenium RAT has evolved into a native C++ application used by Y2K Operators to compromise over 62,000 global targets via Telegram-based command and control.
