Browse public community intelligence reports, source analysis, and threat research.
115 intel reports
ACRStealer campaign leverages a legitimate, Microsoft-signed Korean DLP driver (DCRCVDrv.sys) to perform kernel-context process termination for security software suppression.
The RMRLX malware family uses a multi-stage JavaScript and PowerShell loader to deploy LxBaseRAT, a sophisticated .NET tool targeting browser credentials, cryptocurrency wallets, and Discord tokens.
HoneyMyte (Mustang Panda) has updated the CoolClient backdoor with a signed kernel-mode rootkit, msagent.sys, to hide and protect malicious artifacts on Windows systems.
Adversaries are globally leveraging the ClickFix social engineering technique to trick Windows and macOS users into executing malicious terminal commands that deliver infostealers and RATs.
An exploit chain leveraging a Unisoc modem RCE via VoLTE SIP messages achieves full Android kernel access by exploiting improper SoC resource isolation (CWE-1189).
Abyssos is a new modular C++ RAT utilizing LLVM-based obfuscation and a custom TCP protocol to perform credential theft, remote access via VNC, and network reconnaissance.
The North Korean-linked threat actor Larva-26005 is targeting South Korean users by distributing the Xctdoor and XcLoader backdoors through spear phishing and installers disguised as legitimate security programs.
A state-sponsored threat group and Gunra ransomware actors exploited vulnerabilities in South Korean financial security software like AnySign4PC to deploy SIGNBT and COPPERHEDGE backdoors via watering holes.
The Silver Fox group is targeting Japanese industrial manufacturing organizations using a modular three-driver BYOVD framework to deploy ValleyRAT for persistent remote access.
INC Ransomware and threat actor UTA0533 are weaponizing a zero-day exploit chain in SonicWall SMA 1000 series appliances to achieve root access and deploy memory-resident malware.
