Browse public community intelligence reports, source analysis, and threat research.
15 intel reports
APT28 (Swallowtail) is targeting NATO defense contractors and law enforcement using the HOOKEDGE backdoor, reverse SSH tunnels, and an undocumented reflective loader named ld.exe.
Armorsteal is a Python-based malware kit delivered via SEO poisoning that exfiltrates browser credentials, Discord tokens, and crypto wallets while deploying hidden XMRig miners.
A fake-download campaign uses trojanized Inno Setup installers to deliver various monetization payloads, including proxyware and distributed-computing agents, to compromised Windows devices.
KGB RAT is a Windows-based Malware-as-a-Service (MaaS) tool providing Remote Access Trojan capabilities, including credential theft, HVNC, ransomware, and cryptocurrency wallet swapping.
Russian-speaking actors NyashTeam and Kapchenka operate Salat Stealer (WEB_RAT), a Go-based MaaS targeting Windows for credential and cryptocurrency theft.
Midnight Blizzard-linked actor GTG-20006 utilized AI-assisted code generation to modify PowerShell stagers and Go backdoors targeting government and defense organizations via device-code phishing.
CrocoRat is a Python-based remote access trojan and cryptocurrency stealer delivered via ClickFix social engineering and novel DNS TXT record payload staging.
LausivLoader utilizes a multi-stage infection chain involving JavaScript, PowerShell, and .NET, leveraging environment variable inheritance for inter-process data handoff and steganography to deliver final payloads.
Threat actors are abusing FTP banners as Dead Drop Resolvers (DDRs) to deliver novel RATs, E4del and PINHOLE, using legitimate services like Pinterest and SurveyMonkey for configuration retrieval.
The ClickFix EtherHiding campaign leverages compromised WordPress sites to deliver malware by retrieving stage-two payloads from Ethereum smart contracts.
