Browse public community intelligence reports, source analysis, and threat research.
158 intel reports
Adversaries compromised maintainer accounts and CI/CD pipelines to distribute trojanized PyPI and npm packages targeting quantum computing researchers and Alibaba developers.
Midnight Blizzard sub-cluster Storm-2945 is conducting the CaptiveCrunch campaign, leveraging traffic manipulation in hospitality networks to deliver custom Go and PowerShell malware and conduct device code phishing.
A state-sponsored threat group and Gunra ransomware actors exploited vulnerabilities in South Korean financial security software like AnySign4PC to deploy SIGNBT and COPPERHEDGE backdoors via watering holes.
Storm-2945, a sub-cluster of Midnight Blizzard (APT29), is hijacking hospitality Wi-Fi networks to deliver CornFlake RAT and ChocoShell infostealer via DNS poisoning and fake update prompts.
Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.
The 1337_GTWK Linux malware campaign utilizes a sophisticated two-stage infection chain featuring a kernel rootkit and a user-space Go agent to establish persistent control and evade detection.
The Larva-24009 threat actor (HeptaX) targets global enterprises using LNK-based phishing to deploy QuasarRAT, UltraVNC, and NirSoft information-stealing tools.
TOKYOCORE is a sophisticated C++ malware combining ransomware, data theft, and hardware-destructive wiper capabilities, attributed to the actor @meds.
A sophisticated multi-stage campaign uses HijackLoader to deploy Vidar infostealers and the SnappyClient RAT via DLL side-loading and process hollowing.
Mirage Kitten (UNC1549) is deploying a new malware set including the NightLedger backdoor and WebSocket-based tunnelers targeting aerospace, defense, and telecommunications sectors.
