Browse public community intelligence reports, source analysis, and threat research.
143 intel reports
Nova is a Rust-based Ransomware-as-a-Service that employs extensive Microsoft Defender evasion, process termination of security tools, and hybrid encryption to target multiple sectors globally.
Phantom Mantis utilizes a portfolio of kernel-mode tools, including the GentleKiller-related G12/G13 line and the DriverKiller BYOVD tool, to disable endpoint security products before ransomware deployment.
Storm-2945, a sub-cluster of Midnight Blizzard (APT29), is hijacking hospitality Wi-Fi networks to deliver CornFlake RAT and ChocoShell infostealer via DNS poisoning and fake update prompts.
Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.
The 1337_GTWK Linux malware campaign utilizes a sophisticated two-stage infection chain featuring a kernel rootkit and a user-space Go agent to establish persistent control and evade detection.
BTMOB has evolved from a single Malware-as-a-Service operation into a fragmented ecosystem of independent resellers and source-code variants targeting Android users for financial theft.
PolinRider threat actors hijacked two Joyfill npm packages to distribute an obfuscated five-stage malware chain using blockchain-based C2 resolution and a Python credential stealer.
A sophisticated multi-stage campaign uses HijackLoader to deploy Vidar infostealers and the SnappyClient RAT via DLL side-loading and process hollowing.
The pro-Ukrainian threat actor Bearlyfy (Toy Ghouls) is targeting Russian organizations using their custom GenieLocker ransomware across Windows, Linux, and ESXi platforms.
Mirage Kitten (UNC1549) is deploying a new malware set including the NightLedger backdoor and WebSocket-based tunnelers targeting aerospace, defense, and telecommunications sectors.
