Browse public community intelligence reports, source analysis, and threat research.
13 intel reports
The Bitter APT group is targeting South Asian organizations using a new multi-platform RAT called PapRAT across three distinct infection chains leveraging LNK, VHDX, and MSI files.
WinLol is a multi-stage malware toolkit featuring a Rust dropper, an in-memory downloader, and a Go-based RAT that streams victim screens via WebRTC using DLL side-loading of legitimate OneDrive binaries.
Star Blizzard (suspected Russian state-linked) is conducting spearphishing campaigns against Moldovan and Ukrainian civil society using password-protected VHDX files and WebDAV-based persistence.
Suspected Star Blizzard threat actors target Moldovan and Ukrainian civil society using the RedFlick technique, involving conversation-based phishing and VHDX-delivered malware.
Chinese threat actor UTA0565 utilized chained Chrome and Windows zero-day exploits through spoofed domains to deliver a custom obfuscated malware named CLEANGULP targeting government entities.
BabylonRAT is an open-source Remote Access Trojan (RAT) capable of credential theft, keylogging, and DDoS attacks, recently used in campaigns targeting public institutions in Malaysia.
OnyxC2 is a sophisticated Malware-as-a-Service info-stealer and remote access toolkit targeting over 200 applications including crypto wallets, browsers, and 2FA extensions.
The ClickFix EtherHiding campaign leverages compromised WordPress sites to deliver malware by retrieving stage-two payloads from Ethereum smart contracts.
The SMOKE#SCREEN campaign utilizes diverse social engineering lures and aggressive security-dismantling toolsets to deploy persistent ScreenConnect RMM agents on Windows and macOS systems.
Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.
