Browse public community intelligence reports, source analysis, and threat research.
247 intel reports
TASK#STOMP uses a VBScript-orchestrated execution chain to deploy a multi-stage PowerShell backdoor focused on automated document exfiltration, credential theft, and remote access.
The MikroTrick exploit chain combines an SSH state-machine flaw with a login argument injection bug to achieve unauthenticated administrative control over MikroTik RouterOS devices.
The Iranian Ministry of Intelligence and Security (MOIS) uses HEAVYGRAM (aka CHOSEN BRICK) malware to target dissidents and journalists via social engineering and Telegram-based command-and-control.
A threat actor exploited CVE-2025-4632 in Samsung MagicINFO to deploy AnyDesk and compile a custom SilentXMRMiner payload directly on the victim endpoint.
The Macfinger ClickFix campaign targets macOS users by injecting scripts into legitimate websites to deploy Atomic macOS Stealer (AMOS) via fake browser verification prompts.
Iranian state cyber actors are using CHOSEN BRICK, a Windows-based spyware, to monitor dissidents and activists through social engineering and Telegram-based command and control.
Konni, a DPRK-nexus actor, is targeting Ukrainian entities using socio-economic lures to deploy VelvetCake, a modular PowerShell-based task runner and reconnaissance tool.
The Gentlemen threat actor group is utilizing the cross-platform TukTuk C2 framework and BYOVD techniques to neutralize EDR solutions while targeting global technology and healthcare sectors.
Atomic macOS Stealer (AMOS) is being delivered via a sophisticated ClickFix attack chain that uses a deceptive Xcode download site to trick users into executing malicious Terminal commands.
The SideCopy APT is targeting Indian academic institutions using weaponized LNK files and mshta.exe to deploy ReverseRAT via fileless .NET deserialization.
