Browse public community intelligence reports, source analysis, and threat research.
276 intel reports
Mustang Panda uses a diplomatic-themed OIC invitation LNK to deliver the PlugX RAT through multi-stage PowerShell execution and DLL side-loading.
Lumma Stealer is a Malware-as-a-Service infostealer targeting sensitive data via social engineering techniques like ClickFix and deceptive PowerShell execution.
The Iranian state-aligned actor CL-STA-1178 is conducting the 'Blinder Tunnel' campaign targeting Iraqi critical infrastructure using trojanized coding challenges and living-off-the-cloud TTPs.
Threat actors are leveraging malicious ChatGPT Custom GPTs to social engineer victims into executing PowerShell-based ClickFix attacks that deliver sophisticated Remote Access Trojans.
Akira ransomware affiliates utilize RDP for initial access, ProcDump for credential theft, and GOST tunnels for persistence before deploying Rclone for exfiltration and encrypting data.
Russian state actor Star Blizzard is conducting large-scale phishing campaigns against Ukraine-aligned organizations using a novel malware delivery technique called RedFlick to deploy the CosmicPulse backdoor.
The STAC4924 campaign, linked to GOLD VICTOR (Vice Society), uses TerminalFix lures to deploy Lorem Ipsum Loader and custom Python tunneling implants via DLL sideloading.
Unattributed threat actors are leveraging legitimate MSP360 RMM and ConnectWise ScreenConnect installers via phishing to establish persistent remote access and deploy post-compromise tools.
China-nexus actors UAT-11587 and UNC6384 are targeting government, diplomatic, and policy organizations across Asia and Europe using the novel Rust-based Antino backdoor and PlugX RAT via complex multi-stage infection chains.
DragonForce ransomware group is utilizing legitimate Microsoft Teams TURN servers and MQTT brokers for redundant, stealthy C2 communication.
