Browse public community intelligence reports, source analysis, and threat research.
52 intel reports
Kimsuky leverages AI agents like opencode and HeadlessChrome to mass-produce decoy documents while evolving its GitHub-based LNK execution framework with enhanced evasion and persistence.
DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.
Tengu is a Linux-based botnet targeting IoT and server environments, utilizing kernel-worker masquerading and multiple persistence mechanisms to facilitate DDoS attacks.
Toy Ghouls (Bearlyfy) is using new custom backdoors, mqtt-bird-agent and matrix-bird-agent, targeting Russian organizations via HiveMQ and Element C2 channels.
ToxNetV2 is an AArch64 Linux P2P botnet that integrates NVIDIA NIM LLM services into its controller's decision-making loop to propose operational actions.
Chinese-speaking threat actor UAT-10147 leverages agentic AI frameworks like PentestGPT and DeepAudit to automate reconnaissance and exploit validation against Windows and Linux web servers.
A suspected China-nexus actor, designated SilkParasite, utilizes a modular ecosystem of seven RAT families to target government economic bodies in Central Asia via DLL sideloading and Google Drive-backed C2.
China-aligned threat actor ITG27 (Mustang Panda) is targeting the Indian government and energy sector using updated Toneshell v10 and a new VNC-capable backdoor named Havencode.
Lazarus Group's Famous Chollima unit utilizes stolen identities and AI-assisted workflows to infiltrate Western finance and technology firms as remote IT workers.
Direwolf is an emerging ransomware group using custom Golang-based malware and double-extortion tactics to target global organizations, particularly in the manufacturing and technology sectors.
