Browse public community intelligence reports, source analysis, and threat research.
217 intel reports
CountLoader uses multi-stage PowerShell and JavaScript execution via mshta.exe to deploy a cryptocurrency clipper that redirects transactions by hijacking clipboard data.
The Belarus-aligned actor FrostyNeighbor is targeting Ukrainian governmental organizations using updated PicassoLoader variants and victim-validated delivery chains.
The KongTuke group is leveraging Microsoft Teams social engineering to deploy ModeloRAT, escalate privileges via CVE-2023-36036, and harvest domain credentials using fake Windows lock screens.
Kimsuky (APT43) is utilizing updated PebbleDash and AppleSeed malware variants, alongside legitimate tools like VSCode and DWAgent, to target South Korean defense and government entities.
The KongTuke threat actor is impersonating help-desk staff via external Microsoft Teams chats to deploy the multi-path ModeloRAT toolkit for persistent access.
The ClickFix campaign has evolved to deploy PySoxy, an open-source Python SOCKS5 proxy, for redundant encrypted C2 access and persistence following initial social engineering.
APT37 utilizes obfuscated LNK files and multi-stage batch scripts to deploy a Python-based remote access backdoor disguised as a .cat file.
The InstallFix campaign utilizes Google Ads and fake Claude AI installation pages to deliver RedLine Stealer through a complex, multi-stage infection chain.
The HumanitarianBait campaign utilizes Russian-themed aid lures and GitHub-hosted Python implants to establish persistent surveillance and remote access on targeted systems.
An Iranian-nexus threat actor targeted 12 Omani government ministries using a custom C2 framework, ProxyShell exploits, and DotNetNuke vulnerabilities to exfiltrate judicial and citizen data.
