Browse public community intelligence reports, source analysis, and threat research.
16 intel reports
GhostFrame is an ESXi post-exploitation framework that Recorded Future observed in TAG-218 activity overlapping with Settra ransomware operations.
WinLol is a multi-stage malware toolkit featuring a Rust dropper, an in-memory downloader, and a Go-based RAT that streams victim screens via WebRTC using DLL side-loading of legitimate OneDrive binaries.
The PAYLOAD ransomware family hijacked Active Directory Group Policy Objects to deliver ransom notes and disable host security domain-wide without endpoint binaries.
Suspected state-sponsored actors and cybercriminals, including Midnight Blizzard and ShinyHunters, are utilizing generative AI frameworks like PentAGI to automate the cyber kill chain, reconnaissance, and malware development against global targets.
RedTail is a multi-architecture Linux malware that utilizes process masquerading, DNS-over-TLS for C2, and aggressive termination of analysis tools to maintain persistence and evade detection.
China-nexus actor Fire Ant is compromising Cisco Nexus switches and IOS XR routers to harvest credentials and establish covert tunnels into critical infrastructure.
The Iranian threat actor Phosphorus is using a novel PowerShell backdoor dubbed PowerLess that evades detection by executing within a .NET context rather than a standalone process.
CrashStealer is a native C++ macOS information stealer that impersonates Apple crash-reporting tools and uses notarized droppers to harvest credentials, keychain data, and crypto wallets.
Everest is a Russian-speaking ransomware group utilizing a triple-stream business model including file encryption, initial access brokerage, and paid corporate insider recruitment.
IRGC-affiliated actors utilize GigaWiper, a modular Golang-based backdoor combining disk wiping, fake ransomware, and surveillance capabilities against Israeli targets.
