Browse public community intelligence reports, source analysis, and threat research.
19 intel reports
The NEBULA campaign utilizes seven malicious npm packages disguised as NebulaAI SDKs to deliver a customized KNTRAT remote-access trojan using stealthy syscall-based execution.
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
UNC3569 is exploiting a one-click RCE vulnerability (CVE-2026-51990) in Sogou Input Method to deploy the GRAYRABBIT backdoor using a chained attack involving protocol handler injection and an outdated Chromium engine.
The Kim Sooki threat actor utilizes the Syslogk Linux rootkit to achieve persistence and concealment by hooking kernel APIs to hide processes, network connections, and files.
Gamaredon, a Russian FSB-operated group, uses a multi-stage modular framework (GammaPhish, GammaLoad, GammaWorm, GammaSteel) to maintain persistent access and exfiltrate sensitive documents from Ukrainian government and critical infrastructure.
Adversaries can weaponize the legitimate Microsoft-signed BTR.sys remediation driver to perform arbitrary file and registry deletions from Ring 0, bypassing EDR/AV protections.
Threat actors are abusing FTP banners as Dead Drop Resolvers (DDRs) to deliver novel RATs, E4del and PINHOLE, using legitimate services like Pinterest and SurveyMonkey for configuration retrieval.
Adversaries are leveraging NTFS Alternate Data Streams (ADS) to execute malware, which causes Windows to store Prefetch artifacts within secondary streams, effectively hiding execution evidence from standard forensic tools. https://attack.mitre.org/techniques/T1564/004/
A state-sponsored threat group and Gunra ransomware actors exploited vulnerabilities in South Korean financial security software like AnySign4PC to deploy SIGNBT and COPPERHEDGE backdoors via watering holes.
Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.
