Browse public community intelligence reports, source analysis, and threat research.
30 intel reports
An unattributed threat cluster with similarities to SilverFox is targeting Cambodian organizations using a multi-stage infection chain that leverages BYOVD techniques and PNG-based shellcode to deploy SparkRAT.
The ClearFake campaign utilizes a new WordlistLoader to deliver Amatera Stealer (ACR Stealer) through social engineering techniques like FakeCaptcha and advanced WoW64 evasion.
Suspected Russian clusters UNC6293, UNC7005, and UNC5976 are abusing legitimate authentication flows like OAuth and app passwords to target individuals in government, defense, and academia.
The SMOKE#SCREEN campaign utilizes diverse social engineering lures and aggressive security-dismantling toolsets to deploy persistent ScreenConnect RMM agents on Windows and macOS systems.
A state-sponsored threat group and Gunra ransomware actors exploited vulnerabilities in South Korean financial security software like AnySign4PC to deploy SIGNBT and COPPERHEDGE backdoors via watering holes.
Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.
Threat actors are deploying the NetSupport Manager RAT through a multi-stage chain involving phishing PDFs and obfuscated JavaScript to disguise legitimate binaries in a 'Stereo' folder.
Stealth Falcon utilized an LLM-accelerated WebDAV delivery lab to deploy PureRAT via working directory hijacking and DLL sideloading targeting Mexican enterprise users.
The SuccessKey threat actor is targeting Vite ecosystem developers using malicious scoped npm packages that deliver a Remote Access Trojan (RAT) via a multi-tier blockchain C2 infrastructure.
The DEBULL PhaaS framework leverages Microsoft device-code phishing and the GraphSpy post-exploitation tool to compromise Microsoft 365 tenants using Storm-2372-style tradecraft.
