Browse public community intelligence reports, source analysis, and threat research.
18 intel reports
A 3AM ransomware affiliate targeted a UK school estate using a hybrid operation where a human operator guided an agentic AI loop to execute repetitive lateral movement and domain trust configuration tasks.
Akira ransomware targets global organizations across Windows and Linux platforms using double extortion, vulnerability exploitation, and credential theft.
Longlegs (aka Storm-2603), a China-nexus threat actor, is deploying Warlock ransomware against critical infrastructure and government sectors by exploiting SharePoint 'ToolShell' vulnerabilities.
INC Ransomware threat actors utilize Bring Your Own Vulnerable Driver (BYOVD) tactics and dual ransom notes to pressure victims after exfiltrating data via tools like MEGASync.
CRPx0 is a sophisticated cross-platform ransomware-as-a-service operation using ClickFix social engineering lures to deliver multi-stage Python-based payloads via clipboard hijacking.
APT28 and MuddyWater utilize ClickFix variants to compromise organizations via social engineering, deploying multi-stage payloads including steganography and Python-based reverse tunnels for internal network pivoting.
TWINLOOT is a modular Python implant using Microsoft SharePoint, Teams, and headless Edge browsers for stealthy command-and-control and lateral movement.
SynkLoader is a modular Windows malware family distributed via Microsoft Teams phishing that uses a bundled Python environment and in-memory components to facilitate credential theft, tunneling, and remote access.
The pro-Ukrainian threat actor Bearlyfy (Toy Ghouls) is targeting Russian organizations using their custom GenieLocker ransomware across Windows, Linux, and ESXi platforms.
The Payouts King actor targets corporate environments using Microsoft Teams vishing and Quick Assist to deploy a multi-variant Go-based backdoor named GoGRPC.
