Browse public community intelligence reports, source analysis, and threat research.
94 intel reports
Mustang Panda uses a diplomatic-themed OIC invitation LNK to deliver the PlugX RAT through multi-stage PowerShell execution and DLL side-loading.
Everest is a sophisticated .NET-based ransomware that employs aggressive lateral movement, service termination, and process self-protection while targeting Windows environments.
Threat actors are targeting internet-exposed MSSQL servers via SA account brute forcing to deploy XMRig miners using xp_cmdshell and multi-layered persistence.
A suspected China-based threat actor exploited file upload vulnerabilities in a recreation management platform to deploy webshells and steal payment card data.
Sauron Loader is a novel Russian-language Malware-as-a-Service that utilizes social engineering, DLL side-loading, and in-memory decryption to deliver multi-stage payloads.
A variant of SectopRAT uses a multi-stage loader and tampered legitimate DLLs to exfiltrate credentials and control systems via encrypted C2 communication.
Exvicy is an emerging Malware-as-a-Service framework that copycats ErrTraffic, using fake Cloudflare Turnstile challenges to deceive users into executing malicious PowerShell commands via the Win+R shortcut.
The SideCopy APT is targeting Indian academic institutions using weaponized LNK files and mshta.exe to deploy ReverseRAT via fileless .NET deserialization.
The ClickFix campaign compromised a regional news outlet using malicious JavaScript to deliver social engineering prompts that lead to the execution of an encrypted .NET infostealer.
Atomic macOS (AMOS) Stealer targets macOS users through social engineering campaigns masquerading as software toolkits, exfiltrating browser data, credentials, and cryptocurrency wallets.
