Browse public community intelligence reports, source analysis, and threat research.
277 intel reports
Lucid Stealer is a Node.js-based information stealer and RAT that uses Single Executable Application packaging to deliver modular payloads for credential theft and remote control.
The financially motivated threat actor Woodgnat is deploying the stealthy Backdoor.Mistic via DLL side-loading to facilitate ransomware access for affiliates.
pyCodeV3 is a multi-stage Python loader using dynamic domain generation and pickle deserialization to execute arbitrary code from C2 servers.
Head Mare APT exploits a chain of vulnerabilities in TrueConf Server to distribute PhantomCore and PhantomGraph backdoors via Trojanized client installers.
The ClickFix EtherHiding campaign leverages compromised WordPress sites to deliver malware by retrieving stage-two payloads from Ethereum smart contracts.
The SMOKE#SCREEN campaign utilizes diverse social engineering lures and aggressive security-dismantling toolsets to deploy persistent ScreenConnect RMM agents on Windows and macOS systems.
UNC6692 uses email bombing and IT impersonation via Microsoft Teams to deploy the Edgecution/SNOW malware suite and facilitate ransomware access.
An unidentified threat actor leveraged SQL injection on a Tomcat application to install a database-resident post-exploitation toolkit called khunt on an Oracle server.
The threat actor STAC4749 uses Microsoft Teams vishing to impersonate IT support, gaining remote access to deploy custom loaders, backdoors, and Chaos ransomware targeting North American organizations.
Researchers identified a method for malware to abuse Windows Hello for Business keys to authenticate to Entra ID and register rogue devices for long-term persistence.
