Browse public community intelligence reports, source analysis, and threat research.
83 intel reports
Liushen is a Python-based ransomware framework that utilizes process hollowing, MBR modification, and extensive anti-analysis techniques to encrypt victim data and inhibit recovery.
The SStar Agent is a Go-based cross-platform RAT delivered via a poisoned npm package (tw-style-utils) targeting Web3 developers with surveillance and exfiltration capabilities.
The Yuta/Solara campaign distributes a Python-based port of Glove Stealer targeting Roblox users and developers with advanced Chrome App-Bound Encryption bypasses.
JS.MonoGlyphRAT is a persistent JScript backdoor targeting US technology, MSSP, and telecom sectors using monoglyph-obfuscated scripts and encrypted PowerShell stagers.
The Belarus-aligned actor FrostyNeighbor is targeting Ukrainian governmental organizations using updated PicassoLoader variants and victim-validated delivery chains.
Spanish and Portuguese speaking threat actors are utilizing agentic AI to automate full-chain intrusions against government and financial sectors in Latin America.
The HumanitarianBait campaign utilizes Russian-themed aid lures and GitHub-hosted Python implants to establish persistent surveillance and remote access on targeted systems.
A Qilin ransomware affiliate is targeting WatchGuard and Fortinet appliances using multiple CVEs to deploy Sliver C2 and establish reverse SOCKS tunnels into internal networks.
MiniRAT is a Go-based macOS remote access trojan delivered via the compromised velora-dex-sdk npm package, utilizing LaunchAgent persistence and AES-encrypted C2 configurations.
TeamPCP executed a supply chain attack on the elementary-data PyPI package using GitHub Actions injection to distribute a credential-stealing payload targeting data engineers.
