Browse public community intelligence reports, source analysis, and threat research.
9 intel reports
Threat actor TeamPCP executed a massive supply chain campaign compromising GitHub Actions from Aqua Security and Checkmarx, VS Code extensions, and npm packages to deploy a multi-stage credential stealer and a self-propagating worm.
Russia-aligned threat actor UAC-0099 has evolved its custom MATCHBOIL downloader with enhanced obfuscation, sandbox evasion, and timer-based payload delivery targeting Ukrainian sectors.
The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.
SynkLoader is a modular Windows malware family distributed via Microsoft Teams phishing that uses a bundled Python environment and in-memory components to facilitate credential theft, tunneling, and remote access.
ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.
The Iranian threat actor Phosphorus is using a novel PowerShell backdoor dubbed PowerLess that evades detection by executing within a .NET context rather than a standalone process.
The PhantomEnigma campaign leverages compromised Brazilian .gov.br infrastructure to deliver a modular Node.js backdoor aimed at banking credential theft.
Cavern Manticore, an Iran-nexus APT group, utilizes a modular .NET C2 framework targeting Israeli government and IT sectors through RMM abuse and DLL sideloading.
The Mini Shai-Hulud malware targets SAP npm packages to steal developer and cloud credentials using an obfuscated Bun-based execution framework.
