Browse public community intelligence reports, source analysis, and threat research.
277 intel reports
Threat actors are abusing the legitimate Faronics Deploy platform to execute malicious PowerShell scripts and establish persistent remote access via ScreenConnect.
The suspected APT29 group (Cloaked Ursa) launched the Spring Ring campaign targeting over 150 employees with Microsoft Teams-based voice phishing to deploy RMM tools and custom PowerShell RATs.
BREEZE COMET targets Brazilian financial services and payment systems like Pix using a custom multi-language malware suite and AI-accelerated tradecraft.
ClickFix campaign leverages pcalua.exe and WMI to mount remote WebDAV shares for executing infostealer DLLs via rundll32.exe.
The BRIDGEHEAD campaign utilizes 40 npm typosquatting packages to jump from WSL environments to Windows hosts, deploying a Rust-based stealer for cryptocurrency wallets and browser credentials.
SynkLoader is a modular Windows malware family distributed via Microsoft Teams phishing that uses a bundled Python environment and in-memory components to facilitate credential theft, tunneling, and remote access.
The Iranian threat actor Phosphorus is using a novel PowerShell backdoor dubbed PowerLess that evades detection by executing within a .NET context rather than a standalone process.
Kimsuky targets South Korea and Japan using spear phishing to deploy LNK malware and abuse legitimate remote access tools like AnyDesk and Chrome Remote Desktop.
Chinese-speaking threat actor UAT-10147 leverages agentic AI frameworks like PentestGPT and DeepAudit to automate reconnaissance and exploit validation against Windows and Linux web servers.
TWINLOOT is a sophisticated Python implant utilizing SharePoint for tasking, Teams TURN relays for SOCKS5 tunneling, and headless Edge for stealthy Microsoft Graph API transport.
