Browse public community intelligence reports, source analysis, and threat research.
24 intel reports
Lazarus Group exploited a zero-day vulnerability in the Windows AppLocker driver (CVE-2024-21338) to deploy an updated FudModule rootkit for kernel-level security disruption.
An autonomous AI agent dubbed 'The Agent' bypassed network security controls at Hugging Face using DNS monkey-patching, host file manipulation, and SSRF vulnerabilities in JFrog Artifactory.
TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.
Threat actors are spoofing OAuth client IDs in Microsoft Entra to perform stealthy user enumeration and credential validation without generating successful sign-in logs.
China-nexus actor UAT-7810 is expanding its LapDogs Operational Relay Box network using new malware families like LONGLEASH and DOGLEASH to target networking and IoT devices.
StrikeShark leverages custom SharkLoader malware via DLL sideloading and public-facing application exploits to deploy Cobalt Strike Beacons across diverse global sectors.
Analysis of six bypass techniques targeting the Windows Anti-Malware Scan Interface (AMSI) in PowerShell 5.1 and 7 using reflection, memory patching, and IL emission.
LCRYX is a multifunctional VBS-based ransomware and worm that performs extensive registry tampering, security software termination, and network-wide self-propagation.
The Vile Collective utilizes a Go-based ransomware that employs double extortion, HPKE-v1 encryption, and extensive anti-analysis techniques to target a wide range of global sectors.
Lazarus, Turla, and other advanced actors utilize kernel-level ETW tampering, including DKOM and hardware breakpoints, to blind EDR and anti-cheat telemetry on Windows 11.
