Browse public community intelligence reports, source analysis, and threat research.
125 intel reports
DesckVB RAT operators utilize a multi-stage infection chain starting with malspam and legitimate domain redirection to deploy an in-memory .NET Trojan.
The Iran-nexus group Screening Serpens is targeting technology, aerospace, and defense professionals in the US, Israel, and UAE using advanced AppDomainManager hijacking and new RAT variants.
Nation-state actors including Cloaked Ursa and Curious Serpens are weaponizing the ROADtools framework to enumerate Entra ID environments and maintain persistence through rogue device registration.
Cloud Atlas APT targets government and diplomatic entities in Russia and Belarus using a revamped toolset including VBCloud, PowerShower, and the new PowerCloud data exfiltration script.
Threat actor UNG0002 is targeting Chinese universities using spear-phishing lures related to national fitness standards to deliver Cobalt Strike via DLL side-loading.
The TAX#TRIDENT campaign utilizes fake Indian income tax assessment lures to deliver YTSCRat or unauthorized ManageEngine UEMS agents through various VBScript and ZIP-based infection paths.
SHADOW-WATER-063 uses the polymorphic Banana RAT banking trojan to target Brazilian financial institutions via fileless execution and social engineering.
The Belarus-aligned actor FrostyNeighbor is targeting Ukrainian governmental organizations using updated PicassoLoader variants and victim-validated delivery chains.
Kimsuky (APT43) is utilizing updated PebbleDash and AppleSeed malware variants, alongside legitimate tools like VSCode and DWAgent, to target South Korean defense and government entities.
Gamaredon (UAC-0010) is utilizing spearphishing emails and the CVE-2025-8088 WinRAR vulnerability to deploy GammaDrop and GammaLoad malware against Ukrainian state institutions.
