Browse public community intelligence reports, source analysis, and threat research.
38 intel reports
Microsoft Defender now utilizes Windows Filtering Platform (WFP) integration to monitor inbound remote RPC calls at the OpNum level to detect lateral movement, credential theft, and discovery.
The Miasma threat actor is deploying a self-spreading npm worm that utilizes a 'Phantom Gyp' technique to execute code during installation, targeting cloud credentials and AI coding assistants.
A highly sophisticated multi-stage npm supply chain campaign targeting Red Hat and AI-related packages uses GitHub as an adaptive C2 to deploy the Shai-Hulud infostealer variant 'Miasma'.
The TeamPCP threat group is conducting a large-scale supply chain campaign using the 'Mini Shai-Hulud' worm to compromise npm packages, steal CI/CD and cloud credentials, and autonomously propagate.
The China-aligned APT group Webworm has shifted focus to European government entities using new backdoors EchoCreep and GraphWorm along with custom proxy tools.
The Shai Hulud threat actor compromised SAP CAP framework packages by exploiting an AI coding assistant's GitHub integration to inject malicious code and steal npm OIDC tokens.
The Gentlemen RaaS employs a multi-platform locker suite targeting Windows, Linux, and ESXi environments, utilizing SystemBC and Cobalt Strike for lateral movement and persistence.
TeamPCP executed a cascading supply chain campaign using the CanisterWorm and Cloud Stealer malware to harvest credentials from GitHub Actions and PyPI packages.
