Browse public community intelligence reports, source analysis, and threat research.
98 intel reports
SilverFox actors are targeting Malaysian users via WhatsApp lures that deliver ValleyRAT using DLL side-loading of a signed KuGou Technology executable.
The CARBONATO botnet exploits unauthenticated Docker daemons to deploy an AI-driven Hermes Agent for automated post-exploitation and credential harvesting via Telegram.
A North Korean-linked operation targeted the npm registry using the GHAPPIER loader to establish persistence and remote access via compromised developer credentials.
The MacSync family has evolved from AppleScript-based AMOS variants into a complex multi-stage binary infection chain targeting macOS users and developers to steal crypto and credentials.
The Iranian Ministry of Intelligence and Security (MOIS) uses HEAVYGRAM (aka CHOSEN BRICK) malware to target dissidents and journalists via social engineering and Telegram-based command-and-control.
Konni, a DPRK-nexus actor, is targeting Ukrainian entities using socio-economic lures to deploy VelvetCake, a modular PowerShell-based task runner and reconnaissance tool.
The North Korean threat actor Jade Sleet (TraderTraitor) is targeting DevOps engineers at IT services firms using weaponized Terraform coding projects and macOS backdoors FLATROOF and ROOFDECK.
The RevStealer infostealer uses trojanized Electron applications and blockchain-based C2 failover to target credentials, cryptocurrency wallets, and browser data on Windows systems.
The Iran-linked threat actor Handala Hack uses the HEAVYGRAM Telegram-based backdoor and CRUDEEXCLUDE utility to target dissidents and journalists for surveillance and data exfiltration.
The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.
