Browse public community intelligence reports, source analysis, and threat research.
115 intel reports
Attackers can abuse the legitimate Windows Bind Filter driver (bindflt.sys) to virtualize file paths, allowing malicious code to masquerade as trusted system files and blind EDR sensors.
TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.
UNC-RAID-M8280 uses a cross-platform Rust loader to deploy a customized Sliver C2 implant via abused third-party cloud storage and Cloudflare Tunnel infrastructure.
The OkoBot framework uses TookPS and an automated SSH bot to deliver sophisticated implants that target cryptocurrency seed phrases and browser extensions.
Threat actors compromised an Artlist subdomain using stolen credentials to deploy a ClickFix campaign that uses blockchain-based EtherHiding for evasion and delivers a multi-stage RAT.
An unknown Chinese-speaking APT group is targeting Russian critical sectors by exploiting the ViPNet update system to deploy a suite of malicious modules including HelloInjector and HelloProxy.
A logistics-themed spear-phishing campaign deploys CrySome RAT via a multi-stage chain involving UAC bypass, AMSI patching, and the WinDefCtl utility to disable endpoint defenses.
UAT-7810, a China-nexus infrastructure specialist, builds Operational Relay Box (ORB) networks targeting SOHO and enterprise systems using the LEASH malware family for secondary espionage actors.
Adversaries use advanced sleep obfuscation techniques like Ekko and FOLIAGE to encrypt implants in-memory between callbacks, evading traditional YARA and memory attribute scanning.
A China-nexus threat actor is targeting Indian taxpayers and government infrastructure using a multi-stage infection chain to deploy DcRAT via fake tax utility lures.
