Browse public community intelligence reports, source analysis, and threat research.
13 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).
RATHat is an advanced Android banking trojan that abuses wireless debugging for shell access and utilizes Gemini LLM models for automated UI interaction and victim financial scoring.
The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.
A Chinese-speaking operator uses the PEEP toolkit, a RedExt derivative, to transform Chromium browsers into persistent host-level backdoors via native-messaging bridges.
CISA red teams achieved full domain compromise and sensitive system access in two organizations, highlighting risks in cloud identity permissions and Active Directory Certificate Services (ADCS).
Security researcher Gareth Heyes demonstrates how to bypass CSS sanitizers in major webmail clients to perform real-time keylogging, token theft, and UI defacement.
Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.
BlueNoroff is utilizing an advanced phishing kit to impersonate Zoom and Microsoft Teams, profiling cryptocurrency wallets before delivering tailored malware to high-value targets.
