Browse public community intelligence reports, source analysis, and threat research.
39 intel reports
Transparent Tribe (APT-C-56) utilizes ISO/ZIP-based lure files and LNK execution chains to deploy CrimsonRAT and a custom Golang-based remote access trojan against Indian and South Asian targets.
BabylonRAT is an open-source Remote Access Trojan (RAT) capable of credential theft, keylogging, and DDoS attacks, recently used in campaigns targeting public institutions in Malaysia.
The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.
A suspected Russian-speaking threat actor is using AI-powered agents to exploit a critical PaperCut NG/MF vulnerability chain (CVE-2026-81578 and CVE-2026-82078) to target the education sector globally.
CISA red teams achieved full domain compromise and sensitive system access in two organizations, highlighting risks in cloud identity permissions and Active Directory Certificate Services (ADCS).
A suspected China-nexus actor, designated SilkParasite, utilizes a modular ecosystem of seven RAT families to target government economic bodies in Central Asia via DLL sideloading and Google Drive-backed C2.
China-aligned threat actor ITG27 (Mustang Panda) is targeting the Indian government and energy sector using updated Toneshell v10 and a new VNC-capable backdoor named Havencode.
The Head Mare APT group is exploiting TrueConf Server vulnerabilities to distribute PhantomCore and PhantomGraph backdoors via infected client installers.
China-linked threat actor OP-512 is targeting Windows IIS servers with a custom ASPX/ASHX web shell framework and memory-only privilege escalation tools.
Aeza Group infrastructure is being used to deploy Go-based Mach-O malware through ClickFix social engineering, targeting macOS users to steal credentials and drain cryptocurrency wallets.
