Browse public community intelligence reports, source analysis, and threat research.
247 intel reports
The SleepyDuck operation leverages fake Solidity VS Code extensions and steganographic MP4 files to deliver evjawbreaker implants and ScreenConnect backdoors.
Cluster CL-STA-0954 (UNC5820) exploited multiple Fortinet vulnerabilities, including CVE-2024-47575 and CVE-2025-61624, to deploy a novel memory-resident ARM64 implant named PEERSTITCH against telecommunications providers.
CastleStealer and CastleLoader use browser protection bypasses and ClickFix social engineering to exfiltrate sensitive data and deploy secondary RATs like NetSupport.
Adversaries are actively exploiting multiple zero-day vulnerabilities in Citrix NetScaler ADC and Gateway to deploy persistence mechanisms including PHP-based webshells and remote management tools.
Threat actors are concealing NetSupport Manager RAT payloads within structurally valid MP4 files using ISO-BMFF uuid boxes, delivered via PowerShell loaders from Cloudflare-fronted infrastructure.
DarkCore is a remote access trojan (RAT) that uses a dedicated browser to reuse stolen sessions and route traffic through victims' IP addresses to bypass MFA and security controls.
ClickFix attackers use social engineering to trick users into pasting malicious commands into their OS, bypassing browser-based download protections to deliver infostealers and RATs.
Kimsuky (APT-C-55) utilizes phishing emails with malicious LNK files and supply-chain poisoning of the 'pybroker' library to steal sensitive data from financial and research sectors.
Adversaries, including activity sharing infrastructure history with APT29, are exploiting CVE-2026-42589 in Gotenberg to deploy the 'cache_base' Go-based reverse shell and a broader toolkit.
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
