Intel Exchange

The EDRChoker tool weaponizes Windows Policy-based Quality of Service (QoS) to throttle EDR process bandwidth to 8 bits per second, effectively isolating them from their management servers.

Initial Access Broker Woodgnat (KongTuke) is deploying the Mistic and MLTBackdoor RATs via social engineering and compromised WordPress sites to sell network access to major ransomware affiliates.

An unidentified threat actor used ClickFix social engineering to deploy Potemkin Loader and RMMProject, moving laterally via SMBExec to distribute EtherRAT across 11 hosts.

Threat actors can abuse Windows Quality of Service (QoS) policies via PowerShell or WMI to throttle EDR agent outbound bandwidth to near zero, effectively silencing cloud-based telemetry.

Threat actors are utilizing VHDX disk images to deliver Remcos RAT through a multi-stage process involving WMI execution and reflective .NET loading to bypass security controls.

KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.

The EDRChoker tool abuses Windows Policy-Based Quality of Service (QoS) to starve security agents of bandwidth, causing them to silently time out without generating network block artifacts.

LCRYX is a multifunctional VBS-based ransomware and worm that performs extensive registry tampering, security software termination, and network-wide self-propagation.

Microsoft Defender now utilizes Windows Filtering Platform (WFP) integration to monitor inbound remote RPC calls at the OpNum level to detect lateral movement, credential theft, and discovery.

An unknown threat actor is using JavaScript and PowerShell to deliver .NET malware hidden via steganography in MSI-branded JPEG images hosted on legit services.