Browse public community intelligence reports, source analysis, and threat research.
276 intel reports
Threat actors are increasingly leveraging compromised Microsoft Intune administrative accounts to deploy malicious scripts and perform fleet-wide device wipes.
Phantom Stealer utilizes obfuscated VBScript droppers and .NET loaders with Telegram-based C2 infrastructure to exfiltrate browser credentials and system data.
Threat actors use PowerShell scripts to bypass standard process monitoring, but defenders can leverage the DeviceEvents table in Microsoft Defender XDR to gain visibility into individual command executions.
A likely Iran-nexus activity cluster is deploying BLUERABBIT, a Golang-based backdoor that utilizes RabbitMQ, Redis, and MinIO for C2 and exfiltration prior to disk wiping and ransomware deployment.
Threat actors can abuse the Microsoft WinGet configure command and COM APIs to execute arbitrary PowerShell scripts via YAML files, bypassing standard process monitoring.
An unknown threat actor is using JavaScript and PowerShell to deliver .NET malware hidden via steganography in MSI-branded JPEG images hosted on legit services.
Kimsuky APT utilizes a multi-stage JScript loader to deploy the NUKESPED backdoor, targeting South Korean entities through social engineering lures.
A campaign using Amazon-themed phishing and ClickFix social engineering to deliver the HarborWatch Agent RAT, managed via the Harbor Sentinel Chinese-language admin panel.
BQTLock ransomware utilizes a multi-stage PyInstaller-packed architecture, leveraging Remcos RAT for initial access and Discord/Telegram for covert command-and-control.
The Vile Collective utilizes a Go-based ransomware that employs double extortion, HPKE-v1 encryption, and extensive anti-analysis techniques to target a wide range of global sectors.
