Browse public community intelligence reports, source analysis, and threat research.
24 intel reports
The Iranian state-aligned actor CL-STA-1178 is conducting the 'Blinder Tunnel' campaign targeting Iraqi critical infrastructure using trojanized coding challenges and living-off-the-cloud TTPs.
An intrusion campaign utilizing SEO poisoning delivers PavokwiLoader and RMMCRAT, employing advanced obfuscation and environment gating to deploy Cobalt Strike beacons.
The Russian-aligned Lunex Malware-as-a-Service platform utilizes a complex four-stage attack chain, including BYOVD-based EDR neutralization, to deploy a sophisticated information stealer and C2 agent.
An adversary uses malicious Google Apps Scripts in Google Doc sidebars to deliver AMOS and NetSupport Manager malware targeting both macOS and Windows users.
Threat actors are using fake Grand Theft Auto VI (GTA6) installers to distribute a multi-component malware package including RATs, infostealers, and a wiper.
RedTail is a multi-architecture Linux malware that utilizes process masquerading, DNS-over-TLS for C2, and aggressive termination of analysis tools to maintain persistence and evade detection.
Infrastructure Destruction Squad (BLACKNET-00) utilizes functional Firebase exposure scanners, weak ransomware builders, and ICS reconnaissance tools to target critical infrastructure and commercial sectors.
Threat actors are exploiting ScreenConnect to deploy a four-stage VBScript chain that propagates across active remote sessions, ultimately delivering miners and backdoors.
China-nexus actor Fire Ant is compromising Cisco Nexus switches and IOS XR routers to harvest credentials and establish covert tunnels into critical infrastructure.
An unattributed threat cluster with similarities to SilverFox is targeting Cambodian organizations using a multi-stage infection chain that leverages BYOVD techniques and PNG-based shellcode to deploy SparkRAT.
