Browse public community intelligence reports, source analysis, and threat research.
172 intel reports
TrymeLocker (also known as RageCore) is a destructive .NET ransomware attributed to actor 'inwormmap' that implements aggressive persistence, system sabotage, and C2 via Telegram.
DarkWatchman is a sophisticated, fileless JavaScript-based RAT that uses C# keyloggers and registry-based persistence to evade detection.
Pay2Key operators utilize a multi-stage execution chain involving polyglot scripts, DLL search order hijacking of Avast software, and destruction of system recovery options to deploy ransomware.
The UNK_DeadDrop threat actor targets developers with fake recruitment and code review phishing campaigns to deploy cross-platform malware for cryptocurrency theft.
The GreenBlood ransomware group utilizes a Go-based malware featuring military-grade encryption and double extortion tactics to target global organizations.
DesckVB RAT operators utilize a multi-stage infection chain starting with malspam and legitimate domain redirection to deploy an in-memory .NET Trojan.
The Yuta/Solara campaign distributes a Python-based port of Glove Stealer targeting Roblox users and developers with advanced Chrome App-Bound Encryption bypasses.
The Weedhack Malware-as-a-Service (MaaS) campaign targets Minecraft players with custom JAR files that deploy multi-stage infostealers and RATs using Ethereum-based C2 infrastructure.
SilentCryptoMiner and XMRig variants are being distributed through pirated movie and digital library sites using fake video player updates and DLL side-loading.
JS.MonoGlyphRAT is a persistent JScript backdoor targeting US technology, MSSP, and telecom sectors using monoglyph-obfuscated scripts and encrypted PowerShell stagers.
