Browse public community intelligence reports, source analysis, and threat research.
20 intel reports
The Miasma v3 malware is currently targeting AsyncAPI npm packages via a compromised GitHub Actions release workflow to deliver a persistent Node.js remote access trojan.
Russian-speaking actor UAT-11795 is targeting US and European users with trojanized installers for MobaXterm, WebEx, and Zoom to deploy the novel Starland RAT and WLDR PowerShell agent.
Russian-speaking threat actor UAT-11795 is utilizing ClickFix lures and trojanized software to deploy novel Python-based Starland RAT and PowerShell-based WLDR agent for cryptocurrency theft.
A China-nexus threat actor is targeting Indian taxpayers and government infrastructure using a multi-stage infection chain to deploy DcRAT via fake tax utility lures.
Cavern Manticore, an Iran-nexus threat actor, targets Israeli government and IT sectors using a modular .NET C2 framework employing complex compilation formats as anti-analysis layers.
A customized variant of DcRAT named BeepRAT is being distributed via a Chinese phone number management utility, targeting telecommunications providers with an extensive C2 command framework.
The 'Adblock for YouTube' Chrome extension uses excessive permissions and a remote-controlled injection architecture that could be weaponized for arbitrary code execution on any website.
An active phishing campaign targets hospitality organizations in Europe and Asia using photo-themed ZIP files to deliver a Node.js-based implant called TonRAT.
BlackSuit affiliates use Microsoft Teams vishing and email bombing to deploy Nimbus RAT, a Java-based malware abusing Google Drive for C2.
The PowMix botnet targets Czech organizations using compliance-themed phishing lures and sophisticated PowerShell-based in-memory execution.
