Browse public community intelligence reports, source analysis, and threat research.
12 intel reports
The ROMULUS delivery platform utilizes ClickFix lures and social engineering to distribute diverse payloads including LegionLoader, Atlas RAT, and RomulusLoader targeting global organizations.
Warden Stealer is a Rust-based Malware-as-a-Service that targets AI coding agent tokens, browser data, and cryptocurrency wallets through process injection and anti-VM techniques.
China-nexus threat actors, including Storm-3069, utilize the modular NeedyMantis malware to maintain long-term access in telecommunications, government, and education sectors following initial compromise.
The Rapuncel infostealer is distributed via SEO-optimized fake GitHub organizations, utilizing a Microsoft-signed kernel driver to disable security software.
A state-sponsored threat group and Gunra ransomware actors exploited vulnerabilities in South Korean financial security software like AnySign4PC to deploy SIGNBT and COPPERHEDGE backdoors via watering holes.
Threat actors are using multi-stage AutoIT scripts delivered via phishing to inject VIPKeylogger and MedusaHVNC into legitimate Windows processes like charmap.exe.
A financially motivated campaign by the X3D MINER group uses the Factory-v3 loader framework to deliver Vidar stealer and XMRig miner through malvertising and fake software cracks.
A Vidar malware-as-a-service affiliate is targeting SMBs with a dual-payload infection of the Vidar infostealer and XMRig miner delivered via malicious software cracks.
UNC1549, an Iranian-linked APT, targets global aerospace and defense sectors using fake career portals to deliver custom malware including MiniJunk and MiniBrowse.
The ErrTraffic framework utilizes the ClickFix social engineering tactic and EtherHiding technique to distribute various infostealers and loaders through compromised WordPress sites and AI-themed lures.
