Browse public community intelligence reports, source analysis, and threat research.
143 intel reports
APT42 (suspected Iran-linked) is utilizing AI-assisted phishing and the SpearSpecter campaign to deliver an evolved modular TAMECAT backdoor targeting defense and nuclear energy sectors.
Tengu is an evolved Mirai-derived IoT botnet featuring AEAD-encrypted C2, proxy capabilities, and aggressive self-defense mechanisms targeting Linux and Android systems.
BlueNoroff is utilizing an advanced phishing kit to impersonate Zoom and Microsoft Teams, profiling cryptocurrency wallets before delivering tailored malware to high-value targets.
Anonymous researcher 'bikini' released Exploitarium, a repository containing over 30 proof-of-concept exploits for unpatched vulnerabilities across multiple software projects, including critical flaws in libssh2 and Gitea.
UNC-RAID-M8280 uses a cross-platform Rust loader to deploy a customized Sliver C2 implant via abused third-party cloud storage and Cloudflare Tunnel infrastructure.
TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.
A suspected North Korean cluster, linked to Sapphire Sleet, uses AppleScript to bypass macOS TCC protections and deploy the ptApp backdoor targeting cryptocurrency organizations.
Threat actor I_H8_KDot uses Inland Revenue Authority of Singapore phishing lures to deliver Overlord RAT through malicious VHDX images and DLL sideloading.
The Chinese cybercrime subgroup CylindricalCanine, part of GoldenEyeDog, targets financial organizations and certificate providers using a modified Gh0st RAT and sophisticated code-signing certificate theft.
The OkoBot framework uses TookPS and an automated SSH bot to deliver sophisticated implants that target cryptocurrency seed phrases and browser extensions.
