Browse public community intelligence reports, source analysis, and threat research.
276 intel reports
A multi-stage HTA-based loader uses VBScript and PowerShell to deploy the Lightlife RAT, targeting crypto wallets and establishing persistence via Russian infrastructure.
Latrodectus malware utilizes MSI installers and PowerShell droppers to establish persistence and C2 communication while masquerading as legitimate SentinelOne security software.
DRAYN is a sophisticated multi-stage stealer and loader malware that utilizes 7-Zip SFX archives for deployment and maintains persistent C2 via WebSockets.
DarkWatchman is a sophisticated, fileless JavaScript-based RAT that uses C# keyloggers and registry-based persistence to evade detection.
Russia's FSB-operated Gamaredon group leverages a modular VBScript and PowerShell arsenal targeting Ukraine through advanced persistence and multi-stage loading techniques.
Pay2Key operators utilize a multi-stage execution chain involving polyglot scripts, DLL search order hijacking of Avast software, and destruction of system recovery options to deploy ransomware.
DesckVB RAT operators utilize a multi-stage infection chain starting with malspam and legitimate domain redirection to deploy an in-memory .NET Trojan.
Unknown threat actors are exploiting CVE-2026-5426 in KnowledgeDeliver LMS using hardcoded machine keys to achieve RCE and deploy BLUEBEAM web shells and Cobalt Strike.
A new malware campaign dubbed Argamal targets players of adult games using trojanized installers to deliver a full-featured Remote Access Trojan (RAT).
FAMOUS CHOLLIMA (DPRK) distributes the MicrosoftSystem64 RAT via malicious npm packages, leveraging HuggingFace for binary updates and data exfiltration.
