Browse public community intelligence reports, source analysis, and threat research.
276 intel reports
The Kimsuky threat group is distributing complex Python-based backdoors and downloaders via multi-stage LNK files using scheduled tasks for persistence.
A vulnerability chain in Azure Arc for Windows allows low-privileged users to hijack service communications, escalate to SYSTEM and take over the machine's Azure cloud identity.
North Korean threat actor NICKEL ALLEY is targeting tech professionals via fake job interviews to deliver PyLangGhost RAT and BeaverTail malware through social engineering and malicious GitHub repositories.
A widespread initial access campaign using fraudulent human-verification prompts to trick victims into executing malicious commands via native system tools.
Threat actors are leveraging Windows Toast Notifications and Application User Model IDs to spoof trusted system alerts for credential theft and malicious URL redirection.
A sophisticated PureLog Stealer campaign uses localized copyright violation lures and a multi-stage, fileless execution chain to target multiple global sectors.
