Browse public community intelligence reports, source analysis, and threat research.
217 intel reports
An unknown threat actor is deploying the CloudZ RAT and a custom Pheno plugin to hijack Microsoft Phone Link bridges for the purpose of intercepting SMS-based one-time passwords (OTPs).
China-nexus threat group UAT-8302 targets government entities in South America and southeastern Europe using a suite of shared and custom malware including NetDraft, CloudSorcerer, and VSHELL.
China-aligned actor SHADOW-EARTH-053 targets government and defense sectors in Asia using DLL sideloading, multiple tunneling tools, and exploitation of CVE-2025-55182.
VECT 2.0 ransomware permanently destroys data in files larger than 128 KB due to a critical nonce-handling flaw across Windows, Linux, and ESXi platforms.
Silver Fox threat group utilizes tax-themed phishing to deploy a modified RustSL loader, ValleyRAT, and a new Python-based backdoor named ABCDoor against organizations in Russia and India.
The Gentlemen RaaS employs a multi-platform locker suite targeting Windows, Linux, and ESXi environments, utilizing SystemBC and Cobalt Strike for lateral movement and persistence.
Threat actors including GOLD ENCOUNTER and campaigns STAC4713/STAC3725 are abusing QEMU virtualization to hide backdoors and deploy PayoutsKing and 3AM ransomware.
The PowMix botnet targets Czech organizations using compliance-themed phishing lures and sophisticated PowerShell-based in-memory execution.
The Iranian threat actor MuddyWater (MOIS) is leveraging Russian-speaking TAG-150's CastleRAT and ChainShell malware platforms to target Israeli infrastructure and aerospace sectors.
ClipBanker malware utilizes a complex, multi-stage infection chain starting from trojanized software on GitHub to swap cryptocurrency wallet addresses via clipboard monitoring.
