Browse public community intelligence reports, source analysis, and threat research.
71 intel reports
SystemBC is a Windows-based malware family used as a SOCKS5 proxy and persistent RAT by major ransomware groups to tunnel malicious traffic and execute payloads.
DPRK-aligned actors are deploying macOS.Gaslight, a Rust-based implant that uses adversarial prompt injection to disrupt LLM-assisted malware analysis pipelines.
A cryptocurrency-mining campaign exploits CVE-2026-33017, an unauthenticated RCE in Langflow, to deploy a Go-based miner with aggressive defense evasion and lateral movement capabilities.
The Gentlemen Ransomware-as-a-Service (RaaS) group utilizes a sophisticated EDR-killing framework and targets global organizations using leaked Fortinet VPN credentials.
The Drun Backdoor is a modular two-stage infostealer that utilizes the Chromelevator loader to inject into processes via direct syscalls, targeting browser credentials, session tokens, and gaming accounts.
A low-privileged user can coerce the Windows Store Install Service (SYSTEM) to perform NTLM authentication or execute arbitrary DLLs via UNC-located loose-file package registration.
Rapid Brigantine has pivoted to ClickFix lures on compromised WordPress sites to deploy the Lorem Ipsum Loader following a disruption to their previous malware-signing infrastructure.
Suspected Lazarus Group (DPRK) operators are using malicious VS Code extensions like jupyter-powerdev to deliver a multi-stage backdoor utilizing SharePoint for C2 and Roslyn for in-memory execution.
The Reynolds ransomware group utilizes the NSecKrnl kernel driver to terminate EDR processes and employs double-extortion tactics against enterprise targets.
DirtyFrag is a sophisticated Linux kernel Local Privilege Escalation toolkit that uses page cache corruption and RxRPC/AF_ALG abuse to gain root access.
