Browse public community intelligence reports, source analysis, and threat research.
98 intel reports
Midnight Blizzard-linked actor GTG-20006 utilized AI-assisted code generation to modify PowerShell stagers and Go backdoors targeting government and defense organizations via device-code phishing.
An unidentified threat actor utilizes renamed Python interpreters and custom ._pth files to execute malicious code without command-line arguments, eventually attempting to deploy ScreenConnect via a UAC bypass.
Threat actors are exploiting a remote code execution vulnerability in REDCap servers (CVE-2026-90817) to deploy XMRig miners using fileless techniques and steganography.
The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).
The Brazilian threat actor Exilware utilizes the BraZetsu framework and Hestia Control Panel infrastructure to operate an initial access marketplace targeting Latin American organizations.
A coordinated campaign of 16 malicious Firefox extensions masquerades as Rabby and OKX wallets to intercept and exfiltrate recovery phrases and private keys.
Russian state actor Star Blizzard is conducting large-scale phishing campaigns against Ukraine-aligned organizations using a novel malware delivery technique called RedFlick to deploy the CosmicPulse backdoor.
Suspected Star Blizzard threat actors target Moldovan and Ukrainian civil society using the RedFlick technique, involving conversation-based phishing and VHDX-delivered malware.
Unattributed threat actors are leveraging legitimate MSP360 RMM and ConnectWise ScreenConnect installers via phishing to establish persistent remote access and deploy post-compromise tools.
AgtaBackup RAT uses deceptive Microsoft Store pages to deploy legitimate RMM tools as a bridge for a custom .NET backdoor targeting Windows systems.
