Browse public community intelligence reports, source analysis, and threat research.
20 intel reports
Russia-aligned threat actor UAC-0099 has evolved its custom MATCHBOIL downloader with enhanced obfuscation, sandbox evasion, and timer-based payload delivery targeting Ukrainian sectors.
Two malicious Chrome extensions totaling 900,000 users are exfiltrating AI chat conversations and browsing history to attacker-controlled C2 servers.
China-nexus actors UAT-11587 and UNC6384 are targeting government, diplomatic, and policy organizations across Asia and Europe using the novel Rust-based Antino backdoor and PlugX RAT via complex multi-stage infection chains.
DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.
DPRK-nexus actors, likely Sapphire Sleet, leveraged malicious Rust packages on crates.io to deploy Rustbot, a macOS RAT targeting cloud credentials and cryptocurrency wallets.
SLEEPWALKER is a sophisticated passive DLL backdoor targeting ERAAgent.exe that utilizes a custom bytecode command language and sniffs network traffic for magic trigger packets rather than beaconing.
Blackpoint APG identified Miraak, a modular post-exploitation framework using PostgreSQL/Timescale for C2 communication and featuring Cobalt Strike BOF compatibility.
Researchers discovered CoSnitch, a set of vulnerabilities in Microsoft Copilot Personal allowing one-click data exfiltration and persistent memory poisoning via malicious URLs and web summarization.
Kimsuky targets South Korea and Japan using spear phishing to deploy LNK malware and abuse legitimate remote access tools like AnyDesk and Chrome Remote Desktop.
A suspected China-nexus actor, designated SilkParasite, utilizes a modular ecosystem of seven RAT families to target government economic bodies in Central Asia via DLL sideloading and Google Drive-backed C2.
