Browse public community intelligence reports, source analysis, and threat research.
82 intel reports
Financially motivated actors like Vanilla Tempest are leveraging ClickFix social engineering to deliver modular loaders including BabaDeda, Lorem Ipsum, and Potemkin, ultimately deploying ransomware like Rhysida.
Threat actors are utilizing VHDX disk images to deliver Remcos RAT through a multi-stage process involving WMI execution and reflective .NET loading to bypass security controls.
Suspected Lazarus Group (DPRK) operators are using malicious VS Code extensions like jupyter-powerdev to deliver a multi-stage backdoor utilizing SharePoint for C2 and Roslyn for in-memory execution.
A threat actor operating as Leda Elacoate is conducting a supply chain campaign using trojanized installers for crypto-trading and VPN software to deploy the STX RAT infostealer via DLL sideloading.
Mustang Panda APT utilizes a multi-stage PlugX execution chain involving legitimate G DATA binaries and complex obfuscation to target systems via fake browser updates.
The BoldTealLayer campaign utilizes a sophisticated Lua-driven loader to execute fileless .NET payloads by bypassing AMSI and disabling ETW monitoring.
RemusStealer and the SessionGate framework are distributed through a complex ecosystem of impersonation websites and gated Traffic Distribution Systems (TDS) targeting technical users.
DesckVB RAT operators utilize a multi-stage infection chain starting with malspam and legitimate domain redirection to deploy an in-memory .NET Trojan.
SilentCryptoMiner and XMRig variants are being distributed through pirated movie and digital library sites using fake video player updates and DLL side-loading.
JS.MonoGlyphRAT is a persistent JScript backdoor targeting US technology, MSSP, and telecom sectors using monoglyph-obfuscated scripts and encrypted PowerShell stagers.
