Browse public community intelligence reports, source analysis, and threat research.
247 intel reports
The ClickFix campaign leverages social engineering on Steam forums to trick gamers into executing PowerShell commands that install XMRig crypto miners.
The StopAndProtect operation abuses compromised WordPress sites to distribute a multi-component toolkit for file encryption, data theft, and lateral movement via social engineering.
The ServiceNow Red Team developed Dark, an open-source Mythic C2 agent written in Crystal that features in-memory Beacon Object File (BOF) execution for macOS and Linux.
Adversaries are globally leveraging the ClickFix social engineering technique to trick Windows and macOS users into executing malicious terminal commands that deliver infostealers and RATs.
The ENIBot IoT botnet actively self-propagates via Telnet and ADB brute-forcing to conduct high-volume Layer 7 DDoS attacks.
The North Korean threat actor Andariel (APT45) conducts a blend of strategic cyber espionage and financially motivated ransomware attacks targeting defense, aerospace, nuclear, and healthcare sectors.
Kynx is a C++ infostealer developed with AI assistance that targets browser credentials, crypto wallets, gaming platforms, and AI coding assistants like Claude and Cursor.
Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.
Gunra (also known as Golden Community) is a RaaS operation using a double-extortion model targeting critical infrastructure by exploiting vulnerabilities in Fortinet appliances and leveraging Impacket for lateral movement.
The financially motivated threat actor Woodgnat is deploying the stealthy Backdoor.Mistic via DLL side-loading to facilitate ransomware access for affiliates.
