Browse public community intelligence reports, source analysis, and threat research.
368 intel reports
The Iran-linked threat actor Handala Hack uses the HEAVYGRAM Telegram-based backdoor and CRUDEEXCLUDE utility to target dissidents and journalists for surveillance and data exfiltration.
China-aligned actor FamousSparrow is targeting Latin American governments with SparroWocky, a sophisticated C++ backdoor featuring advanced anti-analysis and modular execution capabilities.
BabylonRAT is an open-source Remote Access Trojan (RAT) capable of credential theft, keylogging, and DDoS attacks, recently used in campaigns targeting public institutions in Malaysia.
The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.
Casbaneiro banking trojan targets Latin American users via geofenced phishing and a multi-stage AutoIt infection chain to exfiltrate financial credentials.
A self-proclaimed bug bounty hunter utilizes LLM-generated JavaScript malware named PhantomRaven to compromise developer environments via typosquatted npm packages for credential theft.
AsyncRAT is delivered through a complex five-stage infection chain involving obfuscated PowerShell, a signed AutoIT interpreter, and memory-only .NET loaders to evade detection.
Threat actors are exploiting critical vulnerabilities in WooCommerce Wholesale Lead Capture and The Events Calendar plugins to deploy PHP web shells and achieve full site takeover.
The Kimsuky group is deploying a new multi-stage LNK malware campaign targeting South Korean financial sectors using GitHub, Dropbox, and WordPress as functional C2 channels.
Multiple espionage threat actors, including China-aligned TA412, are deploying the BlueMoon exploit kit to chain Chrome V8 RCE and Windows kernel LPE vulnerabilities for malware delivery.
