Browse public community intelligence reports, source analysis, and threat research.
68 intel reports
The financially motivated threat actor Woodgnat is deploying the stealthy Backdoor.Mistic via DLL side-loading to facilitate ransomware access for affiliates.
pyCodeV3 is a multi-stage Python loader using dynamic domain generation and pickle deserialization to execute arbitrary code from C2 servers.
A sophisticated macOS ClickFix campaign is now using server-side browser-fingerprinting gates to deliver infostealers like AMOS and MacSync only to genuine macOS environments.
Storm-2945 utilizes a macOS ClickFix social engineering campaign to deliver Atomic Stealer and MacSync malware through sophisticated server-side browser-fingerprinting gates.
Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.
A sophisticated multi-stage campaign uses HijackLoader to deploy Vidar infostealers and the SnappyClient RAT via DLL side-loading and process hollowing.
Wiz Research discovered CosmosEscape, a critical vulnerability in Azure Cosmos DB's Gremlin API allowing full cross-tenant read/write access to databases via a platform-wide master key.
Tengu is an evolved Mirai-derived IoT botnet featuring AEAD-encrypted C2, proxy capabilities, and aggressive self-defense mechanisms targeting Linux and Android systems.
Russia-aligned actors Earth Dahu and SHADOW-EARTH-066 are exploiting a WinRAR path traversal vulnerability to deploy GIFTEDCROOK and espionage modules against Ukrainian organizations.
The FakeAgent campaign utilizes malicious Claude.ai artifacts and SEO poisoning to deliver SectopRAT through DLL sideloading and blockchain-based C2 infrastructure.
