Browse public community intelligence reports, source analysis, and threat research.
102 intel reports
The threat actor Storm-2755, also known as Payroll Pirates, uses adversary-in-the-middle (AiTM) phishing and residential proxies to compromise Microsoft 365 accounts for targeted financial data collection.
A threat group named Motions Vics is conducting a global banking phishing campaign using Telegram bots for credential exfiltration and AnyDesk for remote access.
UNC6780 and MIDNIGHT NEPTUNE target open-source repositories and AI coding environments to deploy credential stealers and backdoors via malicious package dependencies.
The SMOKE#SCREEN campaign utilizes diverse social engineering lures and aggressive security-dismantling toolsets to deploy persistent ScreenConnect RMM agents on Windows and macOS systems.
UNC6692 uses email bombing and IT impersonation via Microsoft Teams to deploy the Edgecution/SNOW malware suite and facilitate ransomware access.
Storm-2945, a sub-cluster of Midnight Blizzard (APT29), is hijacking hospitality Wi-Fi networks to deliver CornFlake RAT and ChocoShell infostealer via DNS poisoning and fake update prompts.
Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.
Threat actor UAT-11764 and ransomware groups Sinobi and Warlock are weaponizing QR phishing and legitimate RMM tools like MeshAgent to bypass MFA and maintain persistent access.
BTMOB has evolved from a single Malware-as-a-Service operation into a fragmented ecosystem of independent resellers and source-code variants targeting Android users for financial theft.
Russian state-supported actors including LAUNDRY BEAR and TA458 are exploiting zero-day vulnerabilities in Zimbra, SOGo, and other webmail clients to exfiltrate sensitive email data from Western government and commercial targets.
