Browse public community intelligence reports, source analysis, and threat research.
99 intel reports
Mustang Panda APT utilizes a multi-stage PlugX execution chain involving legitimate G DATA binaries and complex obfuscation to target systems via fake browser updates.
The IRGC-affiliated Cyber Isnaad Front (ASA) is conducting destructive wiper and OT sabotage operations against Israeli critical infrastructure sectors.
The TAX#TRIDENT campaign utilizes fake Indian income tax assessment lures to deliver YTSCRat or unauthorized ManageEngine UEMS agents through various VBScript and ZIP-based infection paths.
SHADOW-WATER-063 uses the polymorphic Banana RAT banking trojan to target Brazilian financial institutions via fileless execution and social engineering.
The Belarus-aligned actor FrostyNeighbor is targeting Ukrainian governmental organizations using updated PicassoLoader variants and victim-validated delivery chains.
The HumanitarianBait campaign utilizes Russian-themed aid lures and GitHub-hosted Python implants to establish persistent surveillance and remote access on targeted systems.
MiniRAT is a Go-based macOS remote access trojan delivered via the compromised velora-dex-sdk npm package, utilizing LaunchAgent persistence and AES-encrypted C2 configurations.
North Korean threat actor NICKEL ALLEY is targeting tech professionals via fake job interviews to deliver PyLangGhost RAT and BeaverTail malware through social engineering and malicious GitHub repositories.
A South Asian financial institution was targeted by an emerging actor using BRUSHWORM, a modular backdoor with USB spreading capabilities, and BRUSHLOGGER, a side-loaded keylogger.
