Browse public community intelligence reports, source analysis, and threat research.
92 intel reports
DPRK-nexus actors are using fake Web3 job interviews to deliver signed ClickOnce applications that deploy NeedleStealer, an unclassified Rust stealer, and a Go-based hVNC RAT.
The Vectra (formerly Nyxel) actor operates VectraRAT, a custom Go and C++ Malware-as-a-Service platform delivered via Amadey and ClickFix campaigns targeting corporate Windows environments.
State-aligned threat actors, primarily China-linked, are deploying the BlueMoon exploit kit to leverage Chrome and Windows zero-days for rapid espionage campaigns.
REVSTEALER is a comprehensive Windows infostealer using Polygon smart contracts for resilient C2 infrastructure and delivering specialized modules for crypto-mining and reverse proxying.
Suspected Silver Fox actors are targeting Latin American banking and financial sectors using fake DocuSign and NFe tax lures to deliver a custom HVNC backdoor for persistent remote control.
Suspected Silver Fox (Yinhu) threat actors are targeting Chinese-speaking users and multinational operations in China using high-fidelity spoofed vendor sites to deliver persistent implants like ValleyRAT.
The WEEVILPROXY threat actor is deploying JSCeal, a compiled V8 JavaScript malware that uses stolen session cookies to bypass Google authentication and target cryptocurrency investors.
SilkParasite is a China-nexus cyberespionage cluster targeting Central Asian government entities using a modular arsenal of seven RAT families, including five previously undocumented tools and AI-assisted tradecraft.
Silver Fox threat actor is distributing the ValleyRAT backdoor by masquerading as signed adware applications to exfiltrate sensitive data from targets in China and India.
Chinese-speaking threat actor TA4922 is utilizing PackClient, a modular C2 framework sold on Telegram, to target organizations in China and India with tax-themed phishing lures.
