Browse public community intelligence reports, source analysis, and threat research.
276 intel reports
Everest is a sophisticated .NET-based ransomware that employs aggressive lateral movement, service termination, and process self-protection while targeting Windows environments.
The CSuite operation targets US and European organizations using sophisticated phishing lures to steal Microsoft 365 sessions and deploy legitimate RMM tools like ScreenConnect for persistent endpoint access.
AgtaBackup RAT uses deceptive Microsoft Store pages to deploy legitimate RMM tools as a bridge for a custom .NET backdoor targeting Windows systems.
A suspected China-based threat actor exploited file upload vulnerabilities in a recreation management platform to deploy webshells and steal payment card data.
An unidentified attacker utilized MSSQL's xp_cmdshell for command execution and data exfiltration via Base64-encoded chunks during an intrusion involving Viva Aerobus-linked infrastructure.
An unidentified operator using Simplified Chinese tools conducted iOS exploitation via the Coruna kit, multi-vector web attacks, and an AI-assisted gambling SEO campaign.
Ransomware groups including CHAOS, Medusa, and Gunra are increasingly targeting radiology departments and healthcare providers using double-extortion and extortion-only tactics.
RATHat is an advanced Android banking trojan that abuses wireless debugging for shell access and utilizes Gemini LLM models for automated UI interaction and victim financial scoring.
An intrusion campaign utilizing SEO poisoning delivers PavokwiLoader and RMMCRAT, employing advanced obfuscation and environment gating to deploy Cobalt Strike beacons.
Russian-branded ClickFix campaigns are compromising Ukrainian websites to deliver the Psychedelic infostealer and persistent remote access tools using fake CAPTCHA lures.
