Browse public community intelligence reports, source analysis, and threat research.
115 intel reports
China-nexus threat actors are exploiting public-facing phpMyAdmin panels via log poisoning to deploy Nezha monitoring agents and Ghost RAT malware.
StealC and Amadey operate as a coordinated Malware-as-a-Service ecosystem to harvest credentials and provide initial access for ransomware and espionage operations.
A threat actor compromised a Mastra maintainer account to poison 140+ npm packages with a malicious dependency used for cross-platform backdoors and credential exfiltration.
Armored Likho targets government and energy sectors in Russia, Brazil, and Kazakhstan using BusySnake Stealer, a Python-based infostealer distributed via AI-generated loaders and LNK files.
A high-ca pability . NET-based infosteale r targetin g multiple browsers, Discord t okens, an d system f ingerprint s while by passing Ch rome App-B ound Encry ption via DLL inject ion.
StrikeShark leverages custom SharkLoader malware via DLL sideloading and public-facing application exploits to deploy Cobalt Strike Beacons across diverse global sectors.
Remcos RAT is a sophisticated Windows remote access trojan used by actors like APT33 and UAC-0050 for extensive surveillance, credential theft, and full system control.
Akira ransomware actors utilized Bumblebee malware and AdaptixC2 via Bing SEO poisoning to gain initial access, move laterally, and exfiltrate over 75GB of data.
Rapid Brigantine and other cybercrime clusters are utilizing ClickFix social engineering to deploy modular loaders and backdoors including Potemkin, RMMProject, BabaDeda, and Lorem Ipsum.
A massive SEO-driven campaign uses over 90 localized domains to distribute malicious software archives that deploy ScreenConnect as a persistent backdoor for AsyncRAT infections.
