Browse public community intelligence reports, source analysis, and threat research.
86 intel reports
The Gentlemen RaaS group is targeting critical infrastructure using custom Go-based backdoors and ransomware variants that leverage GPO deployment and Bring Your Own Vulnerable Driver (BYOVD) techniques.
The HellCat ransomware group is increasingly exploiting Jira credentials harvested by infostealers like StealC and Amadey to facilitate corporate breaches and data exfiltration.
The ROOTBOY actor is deploying Prinz Eugen, a technically deliberate Go-based ransomware that prioritizes fresh data and utilizes anti-forensics to evade detection.
Threat actors including BlackCat and STORM-0501 are leveraging native Azure features like Encryption Scopes and Customer-Provided Keys to encrypt and hold blob storage for ransom.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
The MovieBox Android malware masquerades as a premium streaming service to perform advanced reconnaissance, data exfiltration, and UI overlay attacks.
The Gentlemen ransomware, operated by the Phantom Mantis group (LARVA-368), has evolved from a RaaS affiliate into an independent operation featuring AI-assisted development and a self-propagating worm module.
LCRYX is a multifunctional VBS-based ransomware and worm that performs extensive registry tampering, security software termination, and network-wide self-propagation.
Makop ransomware utilizes AES+RSA encryption and aggressive anti-recovery techniques such as deleting volume shadow copies and backup catalogs to target diverse Windows environments.
The Reynolds ransomware group utilizes the NSecKrnl kernel driver to terminate EDR processes and employs double-extortion tactics against enterprise targets.
