Browse public community intelligence reports, source analysis, and threat research.
68 intel reports
The Rapuncel infostealer is distributed via SEO-optimized fake GitHub organizations, utilizing a Microsoft-signed kernel driver to disable security software.
Unknown actors compromised MemTensor packages on npm and PyPI to deliver 'sckit', a Go-based worm designed for credential harvesting and self-propagation via CI/CD pipelines.
A variant of SectopRAT uses a multi-stage loader and tampered legitimate DLLs to exfiltrate credentials and control systems via encrypted C2 communication.
Iranian state cyber actors are using CHOSEN BRICK, a Windows-based spyware, to monitor dissidents and activists through social engineering and Telegram-based command and control.
Konni, a DPRK-nexus actor, is targeting Ukrainian entities using socio-economic lures to deploy VelvetCake, a modular PowerShell-based task runner and reconnaissance tool.
The PAYLOAD ransomware family hijacked Active Directory Group Policy Objects to deliver ransom notes and disable host security domain-wide without endpoint binaries.
The RevStealer infostealer uses trojanized Electron applications and blockchain-based C2 failover to target credentials, cryptocurrency wallets, and browser data on Windows systems.
Transparent Tribe (APT-C-56) utilizes ISO/ZIP-based lure files and LNK execution chains to deploy CrimsonRAT and a custom Golang-based remote access trojan against Indian and South Asian targets.
The Iran-linked threat actor Handala Hack uses the HEAVYGRAM Telegram-based backdoor and CRUDEEXCLUDE utility to target dissidents and journalists for surveillance and data exfiltration.
Koktevrat is a multi-stage Android RAT distributed via a fake Polish government application named MandatGO that utilizes Accessibility Services and Firebase for full device control.
