Browse public community intelligence reports, source analysis, and threat research.
47 intel reports
TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.
Sophisticated threat actor UAT-8616 is targeting Cisco Catalyst SD-WAN components using zero-day vulnerabilities to gain root access and manipulate network fabric configurations.
The WP-SHELLSTORM campaign targets WordPress and Joomla installations at scale using automated exploit scanners and webshells for access brokerage.
The China-aligned threat actor UNK_MassTraction is exploiting Roundcube vulnerabilities to deploy IceCube and VShell backdoors against US and Canadian university physics departments.
China-nexus actor UAT-7810 is expanding its LapDogs Operational Relay Box network using new malware families like LONGLEASH and DOGLEASH to target networking and IoT devices.
The North Korean-linked PolinRider campaign has expanded its supply chain targeting across npm, Packagist, Go modules, and Chrome extensions to deploy the DEV#POPPER and OmniStealer malware.
Chinese-speaking threat actor CL-STA-1062 is targeting government and energy sectors in Southeast Asia using a custom .NET backdoor named TinyRCT.
A threat actor known as Poisson utilized Havoc C2 and Tailscale VPN to establish persistent, secondary access into French automotive and individual targets for credential theft.
The EDRChoker tool abuses Windows Policy-Based Quality of Service (QoS) to starve security agents of bandwidth, causing them to silently time out without generating network block artifacts.
DirtyFrag is a sophisticated Linux kernel Local Privilege Escalation toolkit that uses page cache corruption and RxRPC/AF_ALG abuse to gain root access.
