Browse public community intelligence reports, source analysis, and threat research.
217 intel reports
DPRK-linked threat actors are targeting South Korean organizations using LNK files that execute multi-stage PowerShell scripts and abuse GitHub as a command-and-control infrastructure.
The FAUX#ELEVATE campaign uses heavily obfuscated VBScript lures targeting French corporate environments to deploy a multi-stage toolkit including XMRig miners and browser credential stealers.
The Russia-aligned actor Pawn Storm (APT28) is deploying the PRISMEX malware suite via zero-day exploits and advanced steganography to target the Ukrainian defense supply chain and NATO logistics hubs.
The Kimsuky threat group is distributing complex Python-based backdoors and downloaders via multi-stage LNK files using scheduled tasks for persistence.
A Russian-origin .NET remote access toolkit named CTRL uses weaponized LNK files to deploy modular payloads for credential theft, RDP session hijacking, and FRP-based reverse tunneling.
A South Asian financial institution was targeted by an emerging actor using BRUSHWORM, a modular backdoor with USB spreading capabilities, and BRUSHLOGGER, a side-loaded keylogger.
Microsoft Defender blocked a large-scale human-operated ransomware attack that attempted to weaponize Group Policy Objects (GPOs) for security tampering and automated payload distribution.
