Browse public community intelligence reports, source analysis, and threat research.
368 intel reports
The CL-CRI-1171 threat actor operates a mature Pay-Per-Install (PPI) marketplace that leverages SEO poisoning and trojanized YouTube gaming content to distribute OfferLoader and a variety of secondary payloads including Insomnia RAT and ARKTunnel.
The Hagaseca cluster uses THost9, a multi-stage Android RAT and ADB worm that leverages accessibility services and exposed ADB ports to infect physical and containerized Android environments.
A suspected Chinese-speaking threat actor is targeting systems in South Korea to install remote control and proxy tools, including Radmin, UltraVNC, and SoftEther VPN, to weaponize infected hosts as proxy nodes.
DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.
Threat actors are exploiting ScreenConnect to deploy a four-stage VBScript chain that propagates across active remote sessions, ultimately delivering miners and backdoors.
SilkParasite is a China-nexus cyberespionage cluster targeting Central Asian government entities using a modular arsenal of seven RAT families, including five previously undocumented tools and AI-assisted tradecraft.
APT28 and MuddyWater utilize ClickFix variants to compromise organizations via social engineering, deploying multi-stage payloads including steganography and Python-based reverse tunnels for internal network pivoting.
Silk Typhoon is suspected of exploiting a pre-authentication RCE chain in PaperCut NG and MF involving improper access control and unsafe class loading.
Tengu is a Linux-based botnet targeting IoT and server environments, utilizing kernel-worker masquerading and multiple persistence mechanisms to facilitate DDoS attacks.
Gamaredon, a Russian FSB-operated group, uses a multi-stage modular framework (GammaPhish, GammaLoad, GammaWorm, GammaSteel) to maintain persistent access and exfiltrate sensitive documents from Ukrainian government and critical infrastructure.
