Browse public community intelligence reports, source analysis, and threat research.
9 intel reports
Suspected TraderTraitor group targets developers using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware via lookalike domains and GitHub.
The suspected TraderTraitor group is using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware for credential theft and persistent access.
Russian state actor Star Blizzard is conducting large-scale phishing campaigns against Ukraine-aligned organizations using a novel malware delivery technique called RedFlick to deploy the CosmicPulse backdoor.
China-linked threat actor Storm-3069 uses NeedyMantis, a modular post-compromise framework, to maintain long-term access via DLL sideloading and custom encrypted archives.
Kimsuky (APT-C-55) utilizes multi-stage PowerShell and C# malware delivered via disguised installers to target South Korean institutions for intelligence theft.
The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.
A self-proclaimed bug bounty hunter utilizes LLM-generated JavaScript malware named PhantomRaven to compromise developer environments via typosquatted npm packages for credential theft.
A threat actor compromised the jscrambler npm package, delivering cross-platform Rust-based infostealers through malicious preinstall hooks and self-executing functions targeting developers and CI/CD environments.
The Belarus-aligned actor FrostyNeighbor is targeting Ukrainian governmental organizations using updated PicassoLoader variants and victim-validated delivery chains.
