Browse public community intelligence reports, source analysis, and threat research.
276 intel reports
Threat actor SheldIO is deploying Amatera Stealer 4.0.2 via the EVALUSION campaign, featuring advanced evasion techniques and significantly expanded targeting for cryptocurrency wallets and messaging apps.
The KongTuke group is leveraging Microsoft Teams social engineering to deploy ModeloRAT, escalate privileges via CVE-2023-36036, and harvest domain credentials using fake Windows lock screens.
Kimsuky (APT43) is utilizing updated PebbleDash and AppleSeed malware variants, alongside legitimate tools like VSCode and DWAgent, to target South Korean defense and government entities.
The KongTuke threat actor is impersonating help-desk staff via external Microsoft Teams chats to deploy the multi-path ModeloRAT toolkit for persistent access.
Seedworm (MuddyWater) conducted a global espionage campaign in early 2026 using Node.js loaders and DLL sideloading to target manufacturing, government, and financial sectors.
The ClickFix campaign has evolved to deploy PySoxy, an open-source Python SOCKS5 proxy, for redundant encrypted C2 access and persistence following initial social engineering.
APT37 utilizes obfuscated LNK files and multi-stage batch scripts to deploy a Python-based remote access backdoor disguised as a .cat file.
An unknown threat actor is exploiting a critical cPanel authentication bypass (CVE-2026-41940) to target South-East Asian military and government entities for data exfiltration and persistent network access.
The InstallFix campaign utilizes Google Ads and fake Claude AI installation pages to deliver RedLine Stealer through a complex, multi-stage infection chain.
The HumanitarianBait campaign utilizes Russian-themed aid lures and GitHub-hosted Python implants to establish persistent surveillance and remote access on targeted systems.
