Browse public community intelligence reports, source analysis, and threat research.
4 intel reports
A cluster of trojanized npm packages delivers the RedShell Linux implant, which features an AI-driven post-exploitation layer called Red Agent.
A suspected China-nexus actor, designated SilkParasite, utilizes a modular ecosystem of seven RAT families to target government economic bodies in Central Asia via DLL sideloading and Google Drive-backed C2.
The MYRA Linux RAT, distributed via the npm package 'apintergrationpost', utilizes a native C rootkit and fileless execution for persistent system access.
Pay2Key operators utilize a multi-stage execution chain involving polyglot scripts, DLL search order hijacking of Avast software, and destruction of system recovery options to deploy ransomware.
