Browse public community intelligence reports, source analysis, and threat research.
11 intel reports
Storm-2992 operates EvilTokens, an AI-driven Phishing-as-a-Service platform targeting Microsoft 365 through device code authentication abuse to facilitate business email compromise.
ARToken is a Phishing-as-a-Service platform that abuses Microsoft's OAuth 2.0 device code flow to bypass MFA and achieve full Entra tenant takeover.
Gamaredon, a Russian FSB-operated group, uses a multi-stage modular framework (GammaPhish, GammaLoad, GammaWorm, GammaSteel) to maintain persistent access and exfiltrate sensitive documents from Ukrainian government and critical infrastructure.
The Aeternum botnet utilizes the public Polygon blockchain as a decentralized command-and-control infrastructure to distribute XWorm, XMRig, and data-stealing payloads.
Project CAV3RN is a modular espionage framework targeting Israel that uses Google Apps Script as a C2 relay and DNS A-records for channel selection.
Adversaries including Phorpiex and Mozi increasingly utilize direct-to-IP (D2IP) communications to bypass DNS-based security controls and reach hard-coded C2 infrastructure.
The Larva-24009 threat actor (HeptaX) targets global enterprises using LNK-based phishing to deploy QuasarRAT, UltraVNC, and NirSoft information-stealing tools.
The Chaos ransomware group is using a new Rust-based RAT called msaRAT that establishes covert C2 channels by hijacking headless Chrome and Edge browsers via the Chrome DevTools Protocol.
ClickLock Dev uses ClickFix social engineering and aggressive process-killing loops to steal credentials and crypto wallets from macOS users in Europe and North America.
The Russia-aligned Gamaredon group significantly updated its arsenal in 2025, deploying six new PowerShell tools and leveraging legitimate cloud services and tunnels to target Ukrainian military and government institutions.
