Browse public community intelligence reports, source analysis, and threat research.
92 intel reports
Threat actors are using multi-stage AutoIT scripts delivered via phishing to inject VIPKeylogger and MedusaHVNC into legitimate Windows processes like charmap.exe.
The TAG-195 threat group is using the ChonkyChicken RAT and ChromEggscalator helper to bypass Chrome App-Bound encryption and hijack authenticated browser sessions via the ClickFix social engineering technique.
Suspected Chinese-speaking threat actors target Central Asian government sectors using two new obfuscated backdoors, OctLurk and SilkLurk, for data theft and persistent access.
TAG-195 (Golden Chickens) has introduced a new generation of modular malware, including TinyEgg and ChonkyChicken, featuring enhanced browser credential theft and session automation via CDP.
Stealth Falcon utilized an LLM-accelerated WebDAV delivery lab to deploy PureRAT via working directory hijacking and DLL sideloading targeting Mexican enterprise users.
TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.
Russian-speaking actor UAT-11795 is targeting US and European users with trojanized installers for MobaXterm, WebEx, and Zoom to deploy the novel Starland RAT and WLDR PowerShell agent.
Threat actor I_H8_KDot uses Inland Revenue Authority of Singapore phishing lures to deliver Overlord RAT through malicious VHDX images and DLL sideloading.
The Chinese cybercrime subgroup CylindricalCanine, part of GoldenEyeDog, targets financial organizations and certificate providers using a modified Gh0st RAT and sophisticated code-signing certificate theft.
The OkoBot framework uses TookPS and an automated SSH bot to deliver sophisticated implants that target cryptocurrency seed phrases and browser extensions.
