Browse public community intelligence reports, source analysis, and threat research.
276 intel reports
The Shai-Hulud worm and GitRunner C2 framework abuse legitimate, digitally signed GitLab CI runner binaries as persistent backdoors to execute commands via CI/CD pipelines.
The VEIL#DROP framework utilizes Google's Blogspot platform and living-off-the-land binaries to deploy the PureLog Stealer in memory via a multi-stage fileless chain.
Analysis of six bypass techniques targeting the Windows Anti-Malware Scan Interface (AMSI) in PowerShell 5.1 and 7 using reflection, memory patching, and IL emission.
An Italian phishing campaign uses DLL side-loading and Chrome Native Messaging to escape the browser sandbox and execute remote PowerShell commands.
SystemBC is a Windows-based malware family used as a SOCKS5 proxy and persistent RAT by major ransomware groups to tunnel malicious traffic and execute payloads.
The ErrTraffic framework utilizes the ClickFix social engineering tactic and EtherHiding technique to distribute various infostealers and loaders through compromised WordPress sites and AI-themed lures.
An active phishing campaign targets hospitality organizations in Europe and Asia using photo-themed ZIP files to deliver a Node.js-based implant called TonRAT.
Threat actor abdrizak uses typosquatted npm packages like postcss-minify-selector-parser to deliver a multi-stage Windows RAT targeting developer environments.
Initial Access Broker Woodgnat (KongTuke) is deploying the Mistic and MLTBackdoor RATs via social engineering and compromised WordPress sites to sell network access to major ransomware affiliates.
A multi-stage steganographic loader campaign uses .NET-based binaries and bitmap objects to deploy payloads like Remcos RAT, Agent Tesla, and Red Line Stealer primarily targeting users in India.
