Browse public community intelligence reports, source analysis, and threat research.
368 intel reports
The KongTuke threat actor is impersonating help-desk staff via external Microsoft Teams chats to deploy the multi-path ModeloRAT toolkit for persistent access.
Seedworm (MuddyWater) conducted a global espionage campaign in early 2026 using Node.js loaders and DLL sideloading to target manufacturing, government, and financial sectors.
UNC5142 utilizes EtherRAT and the AI-generated TukTuk framework to conduct data exfiltration and deploy The Gentlemen ransomware via decentralized and SaaS infrastructure.
The threat actor Mr_Rot13 is exploiting a critical cPanel authentication bypass (CVE-2026-41940) to deploy Go-based infectors and the 'filemanager' remote access trojan.
The PhantomRaven actor is targeting DeFi, Cloud, and AI developers via 33 malicious NPM packages using a multi-stage Remote Dynamic Dependency chain to harvest credentials.
A Chinese-speaking threat actor compromised DAEMON Tools installers to deploy information collectors, minimalistic backdoors, and the complex QUIC RAT against targeted organizations.
An Iranian-nexus threat actor targeted 12 Omani government ministries using a custom C2 framework, ProxyShell exploits, and DotNetNuke vulnerabilities to exfiltrate judicial and citizen data.
An unknown threat actor is deploying the CloudZ RAT and a custom Pheno plugin to hijack Microsoft Phone Link bridges for the purpose of intercepting SMS-based one-time passwords (OTPs).
China-nexus threat group UAT-8302 targets government entities in South America and southeastern Europe using a suite of shared and custom malware including NetDraft, CloudSorcerer, and VSHELL.
Deep#Door is a sophisticated Python-based Remote Access Trojan (RAT) that uses self-referential batch scripts for deployment and leverages the bore[.]pub tunneling service for stealthy C2 communications.
