Browse public community intelligence reports, source analysis, and threat research.
368 intel reports
Tengu is an evolved Mirai-derived IoT botnet featuring AEAD-encrypted C2, proxy capabilities, and aggressive self-defense mechanisms targeting Linux and Android systems.
Threat actors are using Google Search Ads to deliver SilentMare and HollowMare malware via trojanized utility applications like PDF converters and ZIP tools.
Russia-aligned actors Earth Dahu and SHADOW-EARTH-066 are exploiting a WinRAR path traversal vulnerability to deploy GIFTEDCROOK and espionage modules against Ukrainian organizations.
The TAG-195 threat group is using the ChonkyChicken RAT and ChromEggscalator helper to bypass Chrome App-Bound encryption and hijack authenticated browser sessions via the ClickFix social engineering technique.
Attackers are chaining a REST API batch-route confusion vulnerability (CVE-2026-63030) and a SQL injection (CVE-2026-60137) to achieve unauthenticated remote code execution on WordPress Core.
Suspected Chinese-speaking threat actors target Central Asian government sectors using two new obfuscated backdoors, OctLurk and SilkLurk, for data theft and persistent access.
The Chaos ransomware group is using a new Rust-based RAT called msaRAT that establishes covert C2 channels by hijacking headless Chrome and Edge browsers via the Chrome DevTools Protocol.
A new Windows infostealer called Dolphin X, sold by the actor Kontraktnik, uses AI-driven triage to prioritize high-value corporate and DevOps targets.
BlueNoroff is utilizing an advanced phishing kit to impersonate Zoom and Microsoft Teams, profiling cryptocurrency wallets before delivering tailored malware to high-value targets.
The PhantomEnigma campaign leverages compromised Brazilian .gov.br infrastructure to deliver a modular Node.js backdoor aimed at banking credential theft.
