Browse public community intelligence reports, source analysis, and threat research.
217 intel reports
The Yoba campaign utilizes SEO-poisoned GitHub repositories and fake AI desktop applications to distribute a custom loader that delivers XMRig miners via DLL sideloading.
KGB RAT is a Windows-based Malware-as-a-Service (MaaS) tool providing Remote Access Trojan capabilities, including credential theft, HVNC, ransomware, and cryptocurrency wallet swapping.
The threat actor RareWolf uses a multi-stage batch script to deploy AnyDesk for unauthorized remote access, archive local data, and exfiltrate information via SMTP using the Blat utility.
VulcanRAT207.B leverages RomulusLoader and signed VulkanInfo binaries to establish persistent remote access and kernel-level evasion on Windows systems.
CastleStealer and CastleLoader use browser protection bypasses and ClickFix social engineering to exfiltrate sensitive data and deploy secondary RATs like NetSupport.
Russian-speaking actors NyashTeam and Kapchenka operate Salat Stealer (WEB_RAT), a Go-based MaaS targeting Windows for credential and cryptocurrency theft.
Kimsuky (APT-C-55) utilizes phishing emails with malicious LNK files and supply-chain poisoning of the 'pybroker' library to steal sensitive data from financial and research sectors.
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
CrocoRat is a Python-based remote access trojan and cryptocurrency stealer delivered via ClickFix social engineering and novel DNS TXT record payload staging.
Threat actors associated with Vice Society are utilizing ClickFix social engineering to deploy Lorem Ipsum Loader and Python-based tunnels for network access.
