Browse public community intelligence reports, source analysis, and threat research.
68 intel reports
The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.
A self-proclaimed bug bounty hunter utilizes LLM-generated JavaScript malware named PhantomRaven to compromise developer environments via typosquatted npm packages for credential theft.
A Chinese-speaking operator uses the PEEP toolkit, a RedExt derivative, to transform Chromium browsers into persistent host-level backdoors via native-messaging bridges.
DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.
The Exilware threat group uses the AI-driven BraZetsu Python framework to compromise Windows hosts and monetize access via the 'Infect Marketplace.'
The BRIDGEHEAD campaign utilizes 40 npm typosquatting packages to jump from WSL environments to Windows hosts, deploying a Rust-based stealer for cryptocurrency wallets and browser credentials.
Kimsuky targets South Korea and Japan using spear phishing to deploy LNK malware and abuse legitimate remote access tools like AnyDesk and Chrome Remote Desktop.
A suspected China-nexus actor, designated SilkParasite, utilizes a modular ecosystem of seven RAT families to target government economic bodies in Central Asia via DLL sideloading and Google Drive-backed C2.
The Manic Android malware family targets financial and government services, utilizing unique Wi-Fi and Bluetooth mesh networks to exfiltrate data from offline devices.
Adversaries are globally leveraging the ClickFix social engineering technique to trick Windows and macOS users into executing malicious terminal commands that deliver infostealers and RATs.
