Browse public community intelligence reports, source analysis, and threat research.
158 intel reports
RemusStealer and the SessionGate framework are distributed through a complex ecosystem of impersonation websites and gated Traffic Distribution Systems (TDS) targeting technical users.
A new malware campaign dubbed Argamal targets players of adult games using trojanized installers to deliver a full-featured Remote Access Trojan (RAT).
FAMOUS CHOLLIMA (DPRK) distributes the MicrosoftSystem64 RAT via malicious npm packages, leveraging HuggingFace for binary updates and data exfiltration.
BlackSuit affiliates use Microsoft Teams vishing and email bombing to deploy Nimbus RAT, a Java-based malware abusing Google Drive for C2.
The Weedhack Malware-as-a-Service (MaaS) campaign targets Minecraft players with custom JAR files that deploy multi-stage infostealers and RATs using Ethereum-based C2 infrastructure.
SHADOW-WATER-063 uses the polymorphic Banana RAT banking trojan to target Brazilian financial institutions via fileless execution and social engineering.
The PoisonX threat actor utilizes a complex multi-stage attack chain involving DLL sideloading and vulnerable driver exploitation (BYOVD) to deploy a modular RAT with EDR-bypass capabilities.
Kimsuky (APT43) is utilizing updated PebbleDash and AppleSeed malware variants, alongside legitimate tools like VSCode and DWAgent, to target South Korean defense and government entities.
Seedworm (MuddyWater) conducted a global espionage campaign in early 2026 using Node.js loaders and DLL sideloading to target manufacturing, government, and financial sectors.
The HumanitarianBait campaign utilizes Russian-themed aid lures and GitHub-hosted Python implants to establish persistent surveillance and remote access on targeted systems.
