Browse public community intelligence reports, source analysis, and threat research.
28 intel reports
Chinese-speaking threat actor Gambling Goblin compromises Brazilian government web servers to deploy malicious Apache modules and a broad Linux toolkit for large-scale SEO manipulation and gambling fraud.
Auto-Color is a Linux backdoor that uses a double-forking mechanism and an LD_PRELOAD-based rootkit (libcext.so.2) to hide files and network activity while communicating with a C2 server at 146.70.41.178.
Lazarus Group exploited a zero-day vulnerability in the Windows AppLocker driver (CVE-2024-21338) to deploy an updated FudModule rootkit for kernel-level security disruption.
China-based Jewelbug APT utilizes the XG-Web platform to conduct dual-mission operations involving government espionage across the Middle East and Asia alongside large-scale cryptocurrency fraud.
Lazarus group exploited a Windows AFD.sys zero-day (CVE-2026-68820) to deploy the FudModule rootkit against defense and aviation sectors via trojanized PDF software.
HoneyMyte (Mustang Panda) has updated the CoolClient backdoor with a signed kernel-mode rootkit, msagent.sys, to hide and protect malicious artifacts on Windows systems.
China-based APT Jewelbug conducts simultaneous government espionage across the Middle East and Asia alongside industrial-scale cryptocurrency fraud using a unified C2 framework.
Phantom Mantis utilizes a portfolio of kernel-mode tools, including the GentleKiller-related G12/G13 line and the DriverKiller BYOVD tool, to disable endpoint security products before ransomware deployment.
The 1337_GTWK Linux malware campaign utilizes a sophisticated two-stage infection chain featuring a kernel rootkit and a user-space Go agent to establish persistent control and evade detection.
A China-linked actor is using the advanced Daxin kernel-mode rootkit alongside a novel Stupig backdoor to maintain decade-long persistence in a Taiwan manufacturing firm.
