Browse public community intelligence reports, source analysis, and threat research.
37 intel reports
KGB RAT is a Windows-based Malware-as-a-Service (MaaS) tool providing Remote Access Trojan capabilities, including credential theft, HVNC, ransomware, and cryptocurrency wallet swapping.
Russian-speaking actors NyashTeam and Kapchenka operate Salat Stealer (WEB_RAT), a Go-based MaaS targeting Windows for credential and cryptocurrency theft.
Kimsuky (APT-C-55) utilizes phishing emails with malicious LNK files and supply-chain poisoning of the 'pybroker' library to steal sensitive data from financial and research sectors.
2CLoader is a sophisticated new malware loader identified in August 2026 that uses indirect system calls and environment spoofing to deliver information stealers like Vidar and Remus.
China-based threat actors are deploying RatHat, a sophisticated Android Trojan that leverages generative AI for UI automation and ADB self-pairing for persistent shell access.
An unidentified operator using Simplified Chinese tools conducted iOS exploitation via the Coruna kit, multi-vector web attacks, and an AI-assisted gambling SEO campaign.
The researcher Nightmare Eclipse (aka MSNightmare) has released multiple proof-of-concept exploits targeting Windows Defender, Kaspersky, Avast, CrowdStrike, and NVIDIA drivers to achieve local privilege escalation or denial-of-service.
A local attacker can redirect Meta Muse dictation traffic by modifying an undocumented preference setting, enabling the capture of audio and abuse of the assistant's broad permissions.
Researcher Asim Manizada released working exploits for four Linux kernel vulnerabilities (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) that enable local root access and potential remote crashes.
Koktevrat is a multi-stage Android RAT distributed via a fake Polish government application named MandatGO that utilizes Accessibility Services and Firebase for full device control.
