Browse public community intelligence reports, source analysis, and threat research.
306 intel reports
The suspected Chinese threat actor TA4922 is expanding globally, utilizing new loaders like RomulusLoader and SilentRunLoader alongside Atlas RAT to target organizations in Asia and Europe.
DesckVB RAT operators utilize a multi-stage infection chain starting with malspam and legitimate domain redirection to deploy an in-memory .NET Trojan.
IRGC-affiliated actor Nimbus Manticore deployed the new MiniFast backdoor using AppDomain hijacking and SEO poisoning to target both aviation and software sectors during geopolitical conflict.
The Iran-nexus group Screening Serpens is targeting technology, aerospace, and defense professionals in the US, Israel, and UAE using advanced AppDomainManager hijacking and new RAT variants.
The Kali365 Live PhaaS platform enables large-scale device code phishing and AitM session capture targeting Microsoft 365 environments across multiple sectors.
The Weedhack Malware-as-a-Service (MaaS) campaign targets Minecraft players with custom JAR files that deploy multi-stage infostealers and RATs using Ethereum-based C2 infrastructure.
The TeamPCP threat group is conducting a large-scale supply chain campaign using the 'Mini Shai-Hulud' worm to compromise npm packages, steal CI/CD and cloud credentials, and autonomously propagate.
JS.MonoGlyphRAT is a persistent JScript backdoor targeting US technology, MSSP, and telecom sectors using monoglyph-obfuscated scripts and encrypted PowerShell stagers.
The threat actor vpmdhaj published 14 malicious npm packages typosquatting OpenSearch and ElasticSearch libraries to harvest AWS, HashiCorp Vault, and GitHub Actions credentials.
Threat actors including Aeternum are exploiting CVE-2026-26980 in Ghost CMS to inject malicious JavaScript loaders that facilitate ClickFix social engineering attacks and malware delivery.
