Browse public community intelligence reports, source analysis, and threat research.
113 intel reports
CrashStealer is a native C++ macOS information stealer that impersonates Apple crash-reporting tools and uses notarized droppers to harvest credentials, keychain data, and crypto wallets.
The Helix data extortion group uses social engineering and device code phishing to hijack Microsoft 365 accounts and exfiltrate sensitive SharePoint data.
UAT-7810, a China-nexus threat actor, is expanding its LapDogs Operational Relay Box (ORB) network by compromising networking devices using an updated suite of custom Linux and Java-based malware.
China-nexus actor UAT-7810 is expanding its LapDogs Operational Relay Box network using new malware families like LONGLEASH and DOGLEASH to target networking and IoT devices.
China-nexus threat actors are exploiting public-facing phpMyAdmin panels via log poisoning to deploy Nezha monitoring agents and Ghost RAT malware.
Turla (Secret Blizzard) targets government and military entities globally using the custom STOCKSTAY and Kazuar backdoors, often leveraging hijacked infrastructure.
Armored Likho targets government and energy sectors in Russia, Brazil, and Kazakhstan using BusySnake Stealer, a Python-based infostealer distributed via AI-generated loaders and LNK files.
Cavern Manticore, an Iran-nexus threat actor, targets Israeli government and IT sectors using a modular .NET C2 framework employing complex compilation formats as anti-analysis layers.
Kimsuky (APT43) utilizes a multi-stage CHM-based execution chain to profile systems and selectively deliver follow-on PowerShell payloads to targeted hosts.
A high-ca pability . NET-based infosteale r targetin g multiple browsers, Discord t okens, an d system f ingerprint s while by passing Ch rome App-B ound Encry ption via DLL inject ion.
