Browse public community intelligence reports, source analysis, and threat research.
113 intel reports
Silk Typhoon is suspected of exploiting a pre-authentication RCE chain in PaperCut NG and MF involving improper access control and unsafe class loading.
Lazarus Group is targeting macOS users with trojanized application installers that deliver the OtterCookie RAT through a multi-stage infection chain.
Virtualizor update infrastructure was compromised to deliver the 'nerat' RAT via malicious PHP modifications and a Java-based persistence mechanism on hypervisor nodes.
Stealer/1.0 is a hybrid malware designed to exfiltrate cloud, browser, and developer credentials via Discord webhooks before executing a highly destructive wiper routine that formats the C: drive.
Chinese-speaking threat actor Gambling Goblin compromises Brazilian government web servers to deploy malicious Apache modules and a broad Linux toolkit for large-scale SEO manipulation and gambling fraud.
A 12-year-old critical flaw in PostgreSQL's logical decoding allows low-privileged replication accounts to execute arbitrary code and achieve full superuser persistence.
A suspected Chinese-speaking threat actor exploited vulnerabilities in ownCloud and WordPress to exfiltrate nuclear research records and naval contractor data in the Philippines.
Russian state-sponsored actor BlueDelta utilized macro-enabled Word documents to deploy HOOKEDGE, a batch-script backdoor abusing legitimate webhook services for C2 and exfiltration targeting European government entities.
The Dark Caracal threat actor is deploying a modular Go-based framework named GoCaracal that utilizes Ethereum smart contracts for resilient command-and-control infrastructure.
Kimsuky targets South Korea and Japan using spear phishing to deploy LNK malware and abuse legitimate remote access tools like AnyDesk and Chrome Remote Desktop.
