Browse public community intelligence reports, source analysis, and threat research.
13 intel reports
The MYRA Linux RAT, distributed via the npm package 'apintergrationpost', utilizes a native C rootkit and fileless execution for persistent system access.
A campaign involving hijacked npm and Go packages uses malicious VS Code tasks to trigger a multi-stage infection chain involving blockchain dead drops, a socket.io backdoor, and a Python infostealer.
UNC5221 utilizes the SNOWLIGHT dropper to deploy VSHELL RAT, employing sophisticated evasion like direct syscalls and AMSI patching to compromise Windows systems.
