Browse public community intelligence reports, source analysis, and threat research.
277 intel reports
A suspected China-nexus actor, designated SilkParasite, utilizes a modular ecosystem of seven RAT families to target government economic bodies in Central Asia via DLL sideloading and Google Drive-backed C2.
Threat actors are abusing FTP banners as Dead Drop Resolvers (DDRs) to deliver novel RATs, E4del and PINHOLE, using legitimate services like Pinterest and SurveyMonkey for configuration retrieval.
ACRStealer campaign leverages a legitimate, Microsoft-signed Korean DLP driver (DCRCVDrv.sys) to perform kernel-context process termination for security software suppression.
A multi-stage PureLogs Stealer campaign impersonates Adobe Sign to deliver fileless payloads via image steganography and environment variable manipulation.
The ClickFix campaign leverages social engineering on Steam forums to trick gamers into executing PowerShell commands that install XMRig crypto miners.
The RMRLX malware family uses a multi-stage JavaScript and PowerShell loader to deploy LxBaseRAT, a sophisticated .NET tool targeting browser credentials, cryptocurrency wallets, and Discord tokens.
The StopAndProtect operation abuses compromised WordPress sites to distribute a multi-component toolkit for file encryption, data theft, and lateral movement via social engineering.
Adversaries are globally leveraging the ClickFix social engineering technique to trick Windows and macOS users into executing malicious terminal commands that deliver infostealers and RATs.
Kynx is a C++ infostealer developed with AI assistance that targets browser credentials, crypto wallets, gaming platforms, and AI coding assistants like Claude and Cursor.
UNC5142 utilizes a Python-based RAT named DeviceManager, delivered via ClickFix campaigns, leveraging Ethereum smart contracts for resilient C2 infrastructure resolution and DNS for communication.
