Browse public community intelligence reports, source analysis, and threat research.
135 intel reports
A suspected Chinese threat actor is using SEO poisoning targeting DeepSeek AI users to deliver Kong RAT through a complex multi-stage infection chain.
Mustang Panda is targeting Southeast Asian diplomatic entities using new in-memory ZOHOMURK SOCKS5 tunnelers and MINIRECON automated reconnaissance tools deployed via DLL side-loading.
The ROMULUS delivery platform utilizes ClickFix lures and social engineering to distribute diverse payloads including LegionLoader, Atlas RAT, and RomulusLoader targeting global organizations.
The Yoba campaign utilizes SEO-poisoned GitHub repositories and fake AI desktop applications to distribute a custom loader that delivers XMRig miners via DLL sideloading.
Threat actors including Stardust Chollima and Sandworm are utilizing 'Browser Cache Smuggling' to deliver malware like Vidar Stealer and GeniexRAT by pre-fetching payloads into browser caches to bypass security scans and character limits.
China-linked APT41 (FishMonger) is using BlackX, a UEFI bootkit evolved from BlackLotus, to bypass Secure Boot and maintain persistence on diplomatic targets in Central Asia.
Vapor Panda is utilizing the ARTEX AI-powered framework to conduct large-scale, automated intrusions against over 200 global organizations for intelligence gathering.
The Yoba campaign delivers YobaLoader and XMRig by abusing fake ChatGPT and Claude desktop apps through DLL sideloading and DNS-over-HTTPS C2 techniques.
The Lazarus Group is targeting South Korean sectors by exploiting mandatory financial security software to deploy a sophisticated malware framework featuring post-quantum encryption.
VulcanRAT207.B leverages RomulusLoader and signed VulkanInfo binaries to establish persistent remote access and kernel-level evasion on Windows systems.
