Browse public community intelligence reports, source analysis, and threat research.
113 intel reports
The Millenium RAT has evolved into a native C++ application used by Y2K Operators to compromise over 62,000 global targets via Telegram-based command and control.
The ChocoPoC threat actor is targeting security researchers with trojanized GitHub PoC repositories that install malicious PyPI packages to deliver a Python-based RAT.
Remcos RAT is a sophisticated Windows remote access trojan used by actors like APT33 and UAC-0050 for extensive surveillance, credential theft, and full system control.
Lazarus-linked North Korean actors are targeting software developers via hijacked npm/Go packages and fraudulent job interviews to deploy the InvisibleFerret infostealer.
Mustang Panda targets Indian government and energy sectors using novel ZOHOMURK and MINIRECON implants delivered via DLL sideloading and cloud-based C2.
Threat actors are exploiting an unauthenticated remote code execution vulnerability in Langflow (CVE-2026-33017) to deploy a multi-stage Monero cryptomining toolchain and spread via SSH key reuse.
Chinese-speaking threat actor CL-STA-1062 is targeting government and energy sectors in Southeast Asia using a custom .NET backdoor named TinyRCT.
A cryptocurrency-mining campaign exploits CVE-2026-33017, an unauthenticated RCE in Langflow, to deploy a Go-based miner with aggressive defense evasion and lateral movement capabilities.
A threat actor known as Poisson utilized Havoc C2 and Tailscale VPN to establish persistent, secondary access into French automotive and individual targets for credential theft.
The suspected Muddywater (APT28 variant) actor is deploying the Moodleuni C2 RAT using a fake Inno Setup installer to establish persistence via COM registration and startup shortcuts.
