Browse public community intelligence reports, source analysis, and threat research.
31 intel reports
ClickFix campaigns utilize fake Google and Cloudflare verification pages to trick users into executing PowerShell commands that deliver loaders like ResiLoader and various stealers.
UAC-0226 is utilizing WinRAR path traversal (CVE-2025-8088) with NTFS Alternate Data Streams to deploy the GIFTEDCROOK stealer via a multi-stage PowerShell and reflective loading chain.
A widespread campaign uses typosquatted software sites and SEO poisoning to distribute ScreenConnect, which then drops AsyncRAT onto target systems.
A massive SEO-driven campaign uses over 90 localized domains to distribute malicious software archives that deploy ScreenConnect as a persistent backdoor for AsyncRAT infections.
ShadowDumper and SpecterInsight utilize advanced LSASS memory extraction techniques including in-memory callbacks, direct syscalls from on-disk ntdll, and obfuscation to evade EDR and AV detection.
A multi-stage steganographic loader campaign uses .NET-based binaries and bitmap objects to deploy payloads like Remcos RAT, Agent Tesla, and Red Line Stealer primarily targeting users in India.
Liushen is a Python-based ransomware framework that utilizes process hollowing, MBR modification, and extensive anti-analysis techniques to encrypt victim data and inhibit recovery.
The suspected Chinese threat actor TA4922 is expanding globally, utilizing new loaders like RomulusLoader and SilentRunLoader alongside Atlas RAT to target organizations in Asia and Europe.
DesckVB RAT operators utilize a multi-stage infection chain starting with malspam and legitimate domain redirection to deploy an in-memory .NET Trojan.
SilentCryptoMiner and XMRig variants are being distributed through pirated movie and digital library sites using fake video player updates and DLL side-loading.
