Browse public community intelligence reports, source analysis, and threat research.
19 intel reports
The ChocoPoC threat actor is targeting security researchers with trojanized GitHub PoC repositories that install malicious PyPI packages to deliver a Python-based RAT.
The Russia-aligned Gamaredon group significantly updated its arsenal in 2025, deploying six new PowerShell tools and leveraging legitimate cloud services and tunnels to target Ukrainian military and government institutions.
Rapid Brigantine and other cybercrime clusters are utilizing ClickFix social engineering to deploy modular loaders and backdoors including Potemkin, RMMProject, BabaDeda, and Lorem Ipsum.
The Ousaban banking trojan utilizes geofenced phishing pages and steganography to target users in Spain and Portugal with remote access and credential theft capabilities.
Bluekit PhaaS leverages advanced Browser-in-the-Middle (BitM) techniques and AI to bypass MFA by streaming live DOM interactions to victims.
Initial Access Broker Woodgnat (KongTuke) is deploying the Mistic and MLTBackdoor RATs via social engineering and compromised WordPress sites to sell network access to major ransomware affiliates.
An unidentified threat actor used ClickFix social engineering to deploy Potemkin Loader and RMMProject, moving laterally via SMBExec to distribute EtherRAT across 11 hosts.
Financially motivated actors like Vanilla Tempest are leveraging ClickFix social engineering to deliver modular loaders including BabaDeda, Lorem Ipsum, and Potemkin, ultimately deploying ransomware like Rhysida.
JanelaRAT is an evolving variant of BX RAT targeting financial and cryptocurrency institutions in Latin America through DLL side-loading and sophisticated overlay attacks.
