Browse public community intelligence reports, source analysis, and threat research.
247 intel reports
Threat actors are abusing legitimate Microsoft Power BI domains to host phishing lures that deliver multiple rogue ScreenConnect instances for persistent remote access.
CrocoRat is a Python-based remote access trojan and cryptocurrency stealer delivered via ClickFix social engineering and novel DNS TXT record payload staging.
WinLol is a multi-stage malware toolkit featuring a Rust dropper, an in-memory downloader, and a Go-based RAT that streams victim screens via WebRTC using DLL side-loading of legitimate OneDrive binaries.
Midnight Blizzard-linked actor GTG-20006 utilized AI-assisted code generation to modify PowerShell stagers and Go backdoors targeting government and defense organizations via device-code phishing.
Gryxa is a highly persistent, AI-developed toolkit used by financially motivated actors to steal credentials and maintain durable access via extensive recovery mechanisms.
Chinese state-linked actors Flax Typhoon and Integrity Technology Group are exploiting a suite of legacy and modern vulnerabilities, including Apache Struts RCE, targeting critical infrastructure globally.
An unidentified threat actor utilizes renamed Python interpreters and custom ._pth files to execute malicious code without command-line arguments, eventually attempting to deploy ScreenConnect via a UAC bypass.
A compromised version of the Tensorlake npm package (v0.5.144) distributes the Shai-Hulud worm to steal developer credentials and crypto-wallets while utilizing Ethereum smart contracts for C2 agility.
Threat actor marchos1as uploaded typosquatted AUR packages impersonating yay and paru to execute malicious scripts delivering the CHAOS remote access trojan.
Russia-aligned threat actor UAC-0099 has evolved its custom MATCHBOIL downloader with enhanced obfuscation, sandbox evasion, and timer-based payload delivery targeting Ukrainian sectors.
