Browse public community intelligence reports, source analysis, and threat research.
276 intel reports
A new ClickFix variant uses browser cache smuggling to bypass Windows Run dialog character limits and deploy in-memory .NET credential stealers.
The Yoba campaign utilizes SEO-poisoned GitHub repositories and fake AI desktop applications to distribute a custom loader that delivers XMRig miners via DLL sideloading.
Russian threat actor APT28 compromised a NATO naval shipbuilder and other defense targets using the HOOKEDGE backdoor, a persistent SSH tunnel, and a custom reflective loader.
Russian-speaking actors NyashTeam and Kapchenka operate Salat Stealer (WEB_RAT), a Go-based MaaS targeting Windows for credential and cryptocurrency theft.
STAC4749 utilizes Microsoft Teams external chat and email bombing to impersonate IT support, gaining remote access via legitimate RMM tools to deploy GoGRPC and Chaos ransomware.
The XWorm 6.0 modular malware has resurfaced with over 35 plugins for data theft, ransomware, and persistence, primarily targeting Windows systems via phishing and malicious installers.
Threat actors are concealing NetSupport Manager RAT payloads within structurally valid MP4 files using ISO-BMFF uuid boxes, delivered via PowerShell loaders from Cloudflare-fronted infrastructure.
ClickFix attackers use social engineering to trick users into pasting malicious commands into their OS, bypassing browser-based download protections to deliver infostealers and RATs.
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
Kimsuky (APT-C-55) utilizes phishing emails with malicious LNK files and supply-chain poisoning of the 'pybroker' library to steal sensitive data from financial and research sectors.
