Browse public community intelligence reports, source analysis, and threat research.
3 intel reports
Stealth Falcon utilized an LLM-accelerated WebDAV delivery lab to deploy PureRAT via working directory hijacking and DLL sideloading targeting Mexican enterprise users.
APT28 (Fancy Bear) exploited a chain of vulnerabilities in Windows LNK files to achieve remote code execution and zero-click NTLM authentication coercion.
The Russia-aligned actor Pawn Storm (APT28) is deploying the PRISMEX malware suite via zero-day exploits and advanced steganography to target the Ukrainian defense supply chain and NATO logistics hubs.
