Browse public community intelligence reports, source analysis, and threat research.
97 intel reports
ClickFix attackers use social engineering to trick users into pasting malicious commands into their OS, bypassing browser-based download protections to deliver infostealers and RATs.
Kimsuky (APT-C-55) utilizes phishing emails with malicious LNK files and supply-chain poisoning of the 'pybroker' library to steal sensitive data from financial and research sectors.
Threat actors are abusing legitimate Microsoft Power BI domains to host phishing lures that deliver multiple rogue ScreenConnect instances for persistent remote access.
China-linked APT41 (FishMonger) is using BlackX, a UEFI bootkit evolved from BlackLotus, to bypass Secure Boot and maintain persistence on diplomatic targets in Central Asia.
An unidentified threat actor utilizes renamed Python interpreters and custom ._pth files to execute malicious code without command-line arguments, eventually attempting to deploy ScreenConnect via a UAC bypass.
Star Blizzard (suspected Russian state-linked) is conducting spearphishing campaigns against Moldovan and Ukrainian civil society using password-protected VHDX files and WebDAV-based persistence.
Threat actors are chaining two vulnerabilities in the AhsayCBS backup utility to achieve remote code execution and deploy XMRig cryptominers and JSP webshells.
The Kimsuky threat group is utilizing malicious Hangul (HWP) resume documents to deploy Quasar RAT and ultimately the Funhouse ransomware variant.
Suspected Star Blizzard threat actors target Moldovan and Ukrainian civil society using the RedFlick technique, involving conversation-based phishing and VHDX-delivered malware.
Everest is a sophisticated .NET-based ransomware that employs aggressive lateral movement, service termination, and process self-protection while targeting Windows environments.
