Intel Exchange

The StopAndProtect operation abuses compromised WordPress sites to distribute a multi-component toolkit for file encryption, data theft, and lateral movement via social engineering.

Gunra is a Conti-derived ransomware-as-a-service (RaaS) targeting global critical infrastructure using double-extortion and cross-platform encryptors.

Gunra (also known as Golden Community) is a RaaS operation using a double-extortion model targeting critical infrastructure by exploiting vulnerabilities in Fortinet appliances and leveraging Impacket for lateral movement.

Adversaries are leveraging NTFS Alternate Data Streams (ADS) to execute malware, which causes Windows to store Prefetch artifacts within secondary streams, effectively hiding execution evidence from standard forensic tools. https://attack.mitre.org/techniques/T1564/004/

The SMOKE#SCREEN campaign utilizes diverse social engineering lures and aggressive security-dismantling toolsets to deploy persistent ScreenConnect RMM agents on Windows and macOS systems.

Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.

An unknown threat actor deployed a new Rust-based ransomware called Spirals against a South Asian IT services company using web shell access and rapid lateral movement.

Salat Stealer, a Go-based information stealer, is distributed via gaming utilities like Xeno Executor to harvest credentials, crypto wallets, and perform live surveillance.

The threat actor Hyadina has rebranded Beast ransomware as GodDamn, utilizing the malicious PoisonX kernel driver to disable endpoint defenses via BYOVD attacks.

State-sponsored and cybercriminal actors are utilizing ClickFix Payload-as-a-Service (CPaaS) to deliver dynamically obfuscated malware via fake CAPTCHA social engineering and stealthy clipboard injection.