Browse public community intelligence reports, source analysis, and threat research.
140 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
KGB RAT is a Windows-based Malware-as-a-Service (MaaS) tool providing Remote Access Trojan capabilities, including credential theft, HVNC, ransomware, and cryptocurrency wallet swapping.
Cluster CL-STA-0954 (UNC5820) exploited multiple Fortinet vulnerabilities, including CVE-2024-47575 and CVE-2025-61624, to deploy a novel memory-resident ARM64 implant named PEERSTITCH against telecommunications providers.
Russian-speaking actors NyashTeam and Kapchenka operate Salat Stealer (WEB_RAT), a Go-based MaaS targeting Windows for credential and cryptocurrency theft.
Kimsuky (APT-C-55) utilizes phishing emails with malicious LNK files and supply-chain poisoning of the 'pybroker' library to steal sensitive data from financial and research sectors.
The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).
The suspected TraderTraitor group is using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware for credential theft and persistent access.
Threat actors are chaining two vulnerabilities in the AhsayCBS backup utility to achieve remote code execution and deploy XMRig cryptominers and JSP webshells.
Mustang Panda uses a diplomatic-themed OIC invitation LNK to deliver the PlugX RAT through multi-stage PowerShell execution and DLL side-loading.
ClingSTUN is a Linux back-connect proxy backdoor that exploits numerous IoT vulnerabilities and abuses public STUN infrastructure for NAT traversal and remote command execution.
