Browse public community intelligence reports, source analysis, and threat research.
107 intel reports
Unknown actors compromised MemTensor packages on npm and PyPI to deliver 'sckit', a Go-based worm designed for credential harvesting and self-propagation via CI/CD pipelines.
The North Korean WaterPlum group uses fake job interviews and malicious development tools to compromise IT professionals, stealing over $10.7 million in cryptocurrency.
The Iran-linked threat actor Handala Hack uses the HEAVYGRAM Telegram-based backdoor and CRUDEEXCLUDE utility to target dissidents and journalists for surveillance and data exfiltration.
The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.
DPRK-nexus actors are using fake Web3 job interviews to deliver signed ClickOnce applications that deploy NeedleStealer, an unclassified Rust stealer, and a Go-based hVNC RAT.
The Vectra (formerly Nyxel) actor operates VectraRAT, a custom Go and C++ Malware-as-a-Service platform delivered via Amadey and ClickFix campaigns targeting corporate Windows environments.
A skilled human threat actor exploited a Marimo RCE vulnerability to pivot into an AWS environment in eight seconds, while concurrent campaigns targeted Redis servers for cryptomining and Dahua cameras.
A maintainer compromise on the pub.dev platform led to the injection of malicious build-time scripts targeting developer credentials in the Flutter ecosystem.
CRPx0 is a sophisticated cross-platform ransomware-as-a-service operation using ClickFix social engineering lures to deliver multi-stage Python-based payloads via clipboard hijacking.
REVSTEALER is a comprehensive Windows infostealer using Polygon smart contracts for resilient C2 infrastructure and delivering specialized modules for crypto-mining and reverse proxying.
