Browse public community intelligence reports, source analysis, and threat research.
158 intel reports
The Vectra (formerly Nyxel) actor operates VectraRAT, a custom Go and C++ Malware-as-a-Service platform delivered via Amadey and ClickFix campaigns targeting corporate Windows environments.
State-aligned threat actors, primarily China-linked, are deploying the BlueMoon exploit kit to leverage Chrome and Windows zero-days for rapid espionage campaigns.
REVSTEALER is a comprehensive Windows infostealer using Polygon smart contracts for resilient C2 infrastructure and delivering specialized modules for crypto-mining and reverse proxying.
A Chinese-speaking operator uses the PEEP toolkit, a RedExt derivative, to transform Chromium browsers into persistent host-level backdoors via native-messaging bridges.
Suspected Silver Fox actors are targeting Latin American banking and financial sectors using fake DocuSign and NFe tax lures to deliver a custom HVNC backdoor for persistent remote control.
Infrastructure Destruction Squad (BLACKNET-00) utilizes functional Firebase exposure scanners, weak ransomware builders, and ICS reconnaissance tools to target critical infrastructure and commercial sectors.
Suspected Silver Fox (Yinhu) threat actors are targeting Chinese-speaking users and multinational operations in China using high-fidelity spoofed vendor sites to deliver persistent implants like ValleyRAT.
The Hagaseca cluster uses THost9, a multi-stage Android RAT and ADB worm that leverages accessibility services and exposed ADB ports to infect physical and containerized Android environments.
DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.
The WEEVILPROXY threat actor is deploying JSCeal, a compiled V8 JavaScript malware that uses stolen session cookies to bypass Google authentication and target cryptocurrency investors.
