Browse public community intelligence reports, source analysis, and threat research.
97 intel reports
The Nightmare-Eclipse toolset, including BlueHammer and RedSun, was observed in a live intrusion following initial access via compromised FortiGate VPN credentials.
Deep#Door is a sophisticated Python-based Remote Access Trojan (RAT) that uses self-referential batch scripts for deployment and leverages the bore[.]pub tunneling service for stealthy C2 communications.
The Gentlemen RaaS employs a multi-platform locker suite targeting Windows, Linux, and ESXi environments, utilizing SystemBC and Cobalt Strike for lateral movement and persistence.
APT29 utilizes a multi-stage execution chain involving screensaver droppers, steganography-embedded payloads, and extensive memory manipulation to harvest credentials and move laterally.
SERPENTINE#CLOUD has updated its delivery chain using ClickFix lures and Cloudflare tunnels to deploy a multi-RAT suite including Brute Ratel C4 and PureHVNC.
The CrystalX RAT is a sophisticated Malware-as-a-Service platform written in Go that combines traditional spyware, credential theft, and unique 'prankware' capabilities to target users globally.
Microsoft Defender blocked a large-scale human-operated ransomware attack that attempted to weaponize Group Policy Objects (GPOs) for security tampering and automated payload distribution.
