Browse public community intelligence reports, source analysis, and threat research.
113 intel reports
Makop ransomware utilizes AES+RSA encryption and aggressive anti-recovery techniques such as deleting volume shadow copies and backup catalogs to target diverse Windows environments.
Play Ransomware Group's custom Grixba infostealer has evolved from a monolithic tool to a modular, evasive scanner frequently deployed by DPRK-linked initial access brokers.
The Sauron ransomware operation utilizes a multi-stage toolkit, including Telegram Bot API for data exfiltration and professional-grade system profiling for double extortion.
A highly sophisticated multi-stage npm supply chain campaign targeting Red Hat and AI-related packages uses GitHub as an adaptive C2 to deploy the Shai-Hulud infostealer variant 'Miasma'.
The SStar Agent is a Go-based cross-platform RAT delivered via a poisoned npm package (tw-style-utils) targeting Web3 developers with surveillance and exfiltration capabilities.
The CL-CRI-1089 threat actor is conducting malvertising campaigns targeting macOS users to deploy FlutterShell, a Flutter-based backdoor that facilitates browser hijacking and arbitrary command execution.
Chinese-speaking threat actor lwxat operates a Malware-as-a-Service (MaaS) ecosystem centered on BadIIS, targeting web servers for SEO fraud and malicious redirection.
GhostLock leverages standard Windows API calls to acquire exclusive handles on SMB shares, causing ransomware-like availability denial without encryption or file modifications.
Threat actors compromised the Axios npm package to deliver a multi-platform Remote Access Trojan (RAT) via the malicious dependency 'plain-crypto-js'.
Threat actors compromised the axios npm package to deliver a multi-stage, cross-platform Remote Access Trojan (RAT) via a malicious dependency named plain-crypto-js.
