Browse public community intelligence reports, source analysis, and threat research.
94 intel reports
QuimaRAT is a cross-platform Java-based Remote Access Trojan sold as a service, targeting Windows, Linux, and macOS environments through modular encrypted plugins.
China-nexus threat actors are exploiting public-facing phpMyAdmin panels via log poisoning to deploy Nezha monitoring agents and Ghost RAT malware.
The Veil#Drop framework utilizes a multi-stage infection chain involving JavaScript launchers and PowerShell cradles hosted on Blogspot to deploy PureLog Stealer in memory.
Turla (Secret Blizzard) targets government and military entities globally using the custom STOCKSTAY and Kazuar backdoors, often leveraging hijacked infrastructure.
Banana RAT has evolved its execution chain and C2 infrastructure, transitioning from static ETW-themed paths to randomized persistence and WebSocket communication via Cloudflare.
Kimsuky (APT43) utilizes a multi-stage CHM-based execution chain to profile systems and selectively deliver follow-on PowerShell payloads to targeted hosts.
UAC-0226 is utilizing WinRAR path traversal (CVE-2025-8088) with NTFS Alternate Data Streams to deploy the GIFTEDCROOK stealer via a multi-stage PowerShell and reflective loading chain.
The Millenium RAT has evolved into a native C++ application used by Y2K Operators to compromise over 62,000 global targets via Telegram-based command and control.
The ChocoPoC threat actor is targeting security researchers with trojanized GitHub PoC repositories that install malicious PyPI packages to deliver a Python-based RAT.
A widespread campaign uses typosquatted software sites and SEO poisoning to distribute ScreenConnect, which then drops AsyncRAT onto target systems.
