Browse public community intelligence reports, source analysis, and threat research.
94 intel reports
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
The Ebury botnet hijacked 377 Tor exit relays to intercept SSH connections, steal passwords, and redirect encrypted mail traffic to plaintext ports.
CrocoRat is a Python-based remote access trojan and cryptocurrency stealer delivered via ClickFix social engineering and novel DNS TXT record payload staging.
Midnight Blizzard-linked actor GTG-20006 utilized AI-assisted code generation to modify PowerShell stagers and Go backdoors targeting government and defense organizations via device-code phishing.
The MALFEX threat actor is using malicious npm packages like 'imgdecode' to deliver a native Windows DLL loader that injects shellcode and a remote access tool into developer workstations.
An unidentified threat actor utilizes renamed Python interpreters and custom ._pth files to execute malicious code without command-line arguments, eventually attempting to deploy ScreenConnect via a UAC bypass.
Unknown attackers compromised the Rank Math PRO WordPress plugin version 3.0.123 to deploy self-rebuilding backdoors and unauthorized administrator accounts.
Russia-aligned threat actor UAC-0099 has evolved its custom MATCHBOIL downloader with enhanced obfuscation, sandbox evasion, and timer-based payload delivery targeting Ukrainian sectors.
Earth Sirrush (UAC-0099) utilizes evolving .NET malware, steganographic delivery, and trojanized applications to target Ukrainian government and logistics sectors for long-term espionage.
Candiru and other mercenary spyware vendors use a technique called AdFection to deliver zero-click malware and conduct mass-deanonymization through the real-time bidding advertising ecosystem.
