Browse public community intelligence reports, source analysis, and threat research.
125 intel reports
MadApe is an undocumented phishing kit that abuses Microsoft Device Code authentication via business-themed PDF lures and multi-stage redirects to compromise Microsoft 365 accounts.
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
Mustang Panda is targeting Southeast Asian diplomatic entities using new in-memory ZOHOMURK SOCKS5 tunnelers and MINIRECON automated reconnaissance tools deployed via DLL side-loading.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
SkyW4lker is a device-code phishing kit targeting Microsoft 365 users, primarily in the US technology and manufacturing sectors, to bypass MFA and obtain access tokens.
Russian threat actor APT28 compromised a NATO naval shipbuilder and other defense targets using the HOOKEDGE backdoor, a persistent SSH tunnel, and a custom reflective loader.
The XWorm 6.0 modular malware has resurfaced with over 35 plugins for data theft, ransomware, and persistence, primarily targeting Windows systems via phishing and malicious installers.
Kimsuky (APT-C-55) utilizes phishing emails with malicious LNK files and supply-chain poisoning of the 'pybroker' library to steal sensitive data from financial and research sectors.
Threat actors Storm-3121 and Storm-3032 utilize passkey-themed social engineering and AiTM phishing to compromise Microsoft cloud identities for automated data exfiltration via Microsoft Graph.
Attackers are bypassing the Microsoft 365 RejectDirectSend control by using empty SMTP envelope senders to deliver unauthenticated internal-looking spearphishing emails.
