Browse public community intelligence reports, source analysis, and threat research.
194 intel reports
Deep#Door is a sophisticated Python-based Remote Access Trojan (RAT) that uses self-referential batch scripts for deployment and leverages the bore[.]pub tunneling service for stealthy C2 communications.
Silver Fox threat group utilizes tax-themed phishing to deploy a modified RustSL loader, ValleyRAT, and a new Python-based backdoor named ABCDoor against organizations in Russia and India.
BlueNoroff is targeting Web3 and cryptocurrency executives using AI-generated deepfake meetings and ClickFix clipboard injection to deploy credential stealers.
Threat actors compromised the Axios npm package to deliver a multi-platform Remote Access Trojan (RAT) via the malicious dependency 'plain-crypto-js'.
JanelaRAT is an evolving variant of BX RAT targeting financial and cryptocurrency institutions in Latin America through DLL side-loading and sophisticated overlay attacks.
Threat actors compromised the axios npm package to deliver a multi-stage, cross-platform Remote Access Trojan (RAT) via a malicious dependency named plain-crypto-js.
The threat actor UAT-10362 is targeting Taiwanese NGOs and universities with a modular Lua-based stager called LucidRook and a reconnaissance tool named LucidKnight.
SERPENTINE#CLOUD has updated its delivery chain using ClickFix lures and Cloudflare tunnels to deploy a multi-RAT suite including Brute Ratel C4 and PureHVNC.
North Korean actor Sapphire Sleet compromised the popular Axios npm package to deliver platform-specific RATs via a malicious dependency named plain-crypto-js.
The FAUX#ELEVATE campaign uses heavily obfuscated VBScript lures targeting French corporate environments to deploy a multi-stage toolkit including XMRig miners and browser credential stealers.
