Browse public community intelligence reports, source analysis, and threat research.
75 intel reports
APT28 (Swallowtail) is targeting NATO defense contractors and law enforcement using the HOOKEDGE backdoor, reverse SSH tunnels, and an undocumented reflective loader named ld.exe.
The Lazarus Group is targeting South Korean sectors by exploiting mandatory financial security software to deploy a sophisticated malware framework featuring post-quantum encryption.
The TRUST#GRAFT campaign utilizes a browser-mediated JavaScript loader to hijack authenticated WordPress administrator sessions for the deployment of a persistent PHP backdoor.
Threat actors are increasingly using AI-powered Phishing-as-a-Service (PhaaS) kits like the Jalisco toolkit to bypass MFA via device code phishing and OAuth token harvesting.
Earth Sirrush (UAC-0099) utilizes evolving .NET malware, steganographic delivery, and trojanized applications to target Ukrainian government and logistics sectors for long-term espionage.
Russian state actor Star Blizzard is conducting large-scale phishing campaigns against Ukraine-aligned organizations using a novel malware delivery technique called RedFlick to deploy the CosmicPulse backdoor.
Unattributed threat actors are leveraging legitimate MSP360 RMM and ConnectWise ScreenConnect installers via phishing to establish persistent remote access and deploy post-compromise tools.
Lazarus Group is distributing Graphalgo malware via malicious Terraform providers and Go modules to target infrastructure developers and cryptocurrency assets.
A North Korean-linked operation targeted the npm registry using the GHAPPIER loader to establish persistence and remote access via compromised developer credentials.
An ongoing malicious npm campaign involving 'indexed-btree' and other packages bypasses lifecycle script defenses by burying loaders in runtime prototype methods and using Ethereum smart contracts for C2.
