Browse public community intelligence reports, source analysis, and threat research.
193 intel reports
A trojanized version (2.1.313) of the Anthropic Claude Code VS Code extension plants a persistent SSH reverse tunnel and performs host reconnaissance.
The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.
DPRK-linked actors are utilizing ErrTraffic ClickFix lures on compromised WordPress sites alongside fake recruiter personas to deliver Node.js-based RATs with Polygon-hosted C2 resolvers.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
An extensive phishing campaign impersonating the U.S. District Court targets over 100,000 companies using personalized lures to deliver the LodaRAT remote access trojan via malicious ISO files.
C2Agent is a sophisticated Go-based Windows malware that utilizes Large Language Models (LLMs) and the Model Context Protocol (MCP) to interactively drive post-exploitation activities.
Russian-speaking actors NyashTeam and Kapchenka operate Salat Stealer (WEB_RAT), a Go-based MaaS targeting Windows for credential and cryptocurrency theft.
KGB RAT is a Windows-based Malware-as-a-Service (MaaS) tool providing Remote Access Trojan capabilities, including credential theft, HVNC, ransomware, and cryptocurrency wallet swapping.
Threat actors are concealing NetSupport Manager RAT payloads within structurally valid MP4 files using ISO-BMFF uuid boxes, delivered via PowerShell loaders from Cloudflare-fronted infrastructure.
Threat actors associated with Vice Society are utilizing ClickFix social engineering to deploy Lorem Ipsum Loader and Python-based tunnels for network access.
