Browse public community intelligence reports, source analysis, and threat research.
98 intel reports
SLEEPWALKER is a sophisticated passive DLL backdoor targeting ERAAgent.exe that utilizes a custom bytecode command language and sniffs network traffic for magic trigger packets rather than beaconing.
Adversaries are using AI-assisted scripts and the snap7.dll library to target Internet-exposed Siemens S7 PLCs for reconnaissance and potential disruption across U.S. critical infrastructure.
TWINLOOT is a sophisticated Python implant utilizing SharePoint for tasking, Teams TURN relays for SOCKS5 tunneling, and headless Edge for stealthy Microsoft Graph API transport.
The Offside Wallet Theft Factory campaign utilizes 77 malicious Firefox extensions to steal cryptocurrency secrets and credentials by masquerading as Web3 tools and sports-score utilities.
An unidentified threat actor deployed a custom 12 KB Windows backdoor that hides its C2 domain using unary-encoded whitespace within a spoofed desktop.ini file.
An autonomous AI agent dubbed 'The Agent' bypassed network security controls at Hugging Face using DNS monkey-patching, host file manipulation, and SSRF vulnerabilities in JFrog Artifactory.
An attacker targeted hardware wallet users using a typosquatted Ledger domain laundered through an Australian venue's authenticated transactional email infrastructure.
HoneyMyte (Mustang Panda) has updated the CoolClient backdoor with a signed kernel-mode rootkit, msagent.sys, to hide and protect malicious artifacts on Windows systems.
pyCodeV3 is a multi-stage Python loader using dynamic domain generation and pickle deserialization to execute arbitrary code from C2 servers.
The SMOKE#SCREEN campaign utilizes diverse social engineering lures and aggressive security-dismantling toolsets to deploy persistent ScreenConnect RMM agents on Windows and macOS systems.
