Browse public community intelligence reports, source analysis, and threat research.
37 intel reports
The Reynolds ransomware group utilizes the NSecKrnl kernel driver to terminate EDR processes and employs double-extortion tactics against enterprise targets.
Kimsuky APT utilizes a multi-stage JScript loader to deploy the NUKESPED backdoor, targeting South Korean entities through social engineering lures.
Latrodectus malware utilizes MSI installers and PowerShell droppers to establish persistence and C2 communication while masquerading as legitimate SentinelOne security software.
The Sauron ransomware operation utilizes a multi-stage toolkit, including Telegram Bot API for data exfiltration and professional-grade system profiling for double extortion.
Russia's FSB-operated Gamaredon group leverages a modular VBScript and PowerShell arsenal targeting Ukraine through advanced persistence and multi-stage loading techniques.
Hannibal Stealer is a sophisticated .NET-based information harvester and cryptocurrency stealer that utilizes DLL injection, Telegram-based C2, and clipboard hijacking to target browser data, VPN configurations, and crypto wallets.
Threat actors are leveraging Windows Toast Notifications and Application User Model IDs to spoof trusted system alerts for credential theft and malicious URL redirection.
