Browse public community intelligence reports, source analysis, and threat research.
8 intel reports
KGB RAT is a Windows-based Malware-as-a-Service (MaaS) tool providing Remote Access Trojan capabilities, including credential theft, HVNC, ransomware, and cryptocurrency wallet swapping.
UNC6240 (ShinyHunters) is conducting mass exploitation of CVE-2026-35273 in Oracle PeopleSoft using WAF bypass techniques to deploy SIDEEYE backdoors and MeshCentral agents for extortion.
Kimsuky (APT-C-55) utilizes multi-stage PowerShell and C# malware delivered via disguised installers to target South Korean institutions for intelligence theft.
Kimsuky targets South Korea and Japan using spear phishing to deploy LNK malware and abuse legitimate remote access tools like AnyDesk and Chrome Remote Desktop.
A threat actor compromised a Mastra maintainer account to poison 140+ npm packages with a malicious dependency used for cross-platform backdoors and credential exfiltration.
The suspected Muddywater (APT28 variant) actor is deploying the Moodleuni C2 RAT using a fake Inno Setup installer to establish persistence via COM registration and startup shortcuts.
Cloud Atlas APT targets government and diplomatic entities in Russia and Belarus using a revamped toolset including VBCloud, PowerShower, and the new PowerCloud data exfiltration script.
A South Asian financial institution was targeted by an emerging actor using BRUSHWORM, a modular backdoor with USB spreading capabilities, and BRUSHLOGGER, a side-loaded keylogger.
