Browse public community intelligence reports, source analysis, and threat research.
18 intel reports
The SMOKE#SCREEN campaign utilizes diverse social engineering lures and aggressive security-dismantling toolsets to deploy persistent ScreenConnect RMM agents on Windows and macOS systems.
Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.
An unprivileged user can exploit a logic flaw in the Windows Installer service to delete arbitrary folders as SYSTEM and subsequently execute code by planting malicious rollback scripts.
State-sponsored and cybercriminal actors are utilizing ClickFix Payload-as-a-Service (CPaaS) to deliver dynamically obfuscated malware via fake CAPTCHA social engineering and stealthy clipboard injection.
StrikeShark leverages custom SharkLoader malware via DLL sideloading and public-facing application exploits to deploy Cobalt Strike Beacons across diverse global sectors.
LegionLoader uses a multi-stage infection chain involving MSI files, DLL sideloading, and Python-based components to achieve stealthy execution and C2 communication.
Latrodectus malware utilizes MSI installers and PowerShell droppers to establish persistence and C2 communication while masquerading as legitimate SentinelOne security software.
The TAX#TRIDENT campaign utilizes fake Indian income tax assessment lures to deliver YTSCRat or unauthorized ManageEngine UEMS agents through various VBScript and ZIP-based infection paths.
