Browse public community intelligence reports, source analysis, and threat research.
115 intel reports
Lazarus, Turla, and other advanced actors utilize kernel-level ETW tampering, including DKOM and hardware breakpoints, to blind EDR and anti-cheat telemetry on Windows 11.
The suspected Chinese threat actor TA4922 is expanding globally, utilizing new loaders like RomulusLoader and SilentRunLoader alongside Atlas RAT to target organizations in Asia and Europe.
A heap buffer overflow in 7-Zip (CVE-2026-48095) allows remote code execution via a crafted NTFS image that triggers undefined behavior during decompression buffer allocation.
TeamPCP and other actors are leveraging container escapes via host vulnerabilities (CVE-2024-21626) and misconfigured orchestration APIs to compromise Kubernetes secrets and host systems.
SilverFox APT is targeting users with fake Microsoft Teams download sites to deliver ValleyRAT through a multi-stage DLL sideloading chain and in-memory execution.
CountLoader uses multi-stage PowerShell and JavaScript execution via mshta.exe to deploy a cryptocurrency clipper that redirects transactions by hijacking clipboard data.
Likely state-sponsored actor CL-STA-1132 is exploiting a zero-day buffer overflow (CVE-2026-0300) in PAN-OS Captive Portal to achieve root-level remote code execution.
A Chinese-speaking threat actor compromised DAEMON Tools installers to deploy information collectors, minimalistic backdoors, and the complex QUIC RAT against targeted organizations.
China-nexus threat group UAT-8302 targets government entities in South America and southeastern Europe using a suite of shared and custom malware including NetDraft, CloudSorcerer, and VSHELL.
BlueNoroff is targeting Web3 and cryptocurrency executives using AI-generated deepfake meetings and ClickFix clipboard injection to deploy credential stealers.
