Browse public community intelligence reports, source analysis, and threat research.
97 intel reports
Transparent Tribe (APT-C-56) utilizes ISO/ZIP-based lure files and LNK execution chains to deploy CrimsonRAT and a custom Golang-based remote access trojan against Indian and South Asian targets.
China-aligned actor FamousSparrow is targeting Latin American governments with SparroWocky, a sophisticated C++ backdoor featuring advanced anti-analysis and modular execution capabilities.
A suspected Russian-speaking threat actor is using AI-powered agents to exploit a critical PaperCut NG/MF vulnerability chain (CVE-2026-81578 and CVE-2026-82078) to target the education sector globally.
An unsigned GlobalProtect-themed MSI deploys a backdoor that utilizes Cloudflare Workers for configuration and Google Sheets for C2 communication, specifically targeting victims in Myanmar.
UNC3569 is exploiting a one-click RCE vulnerability (CVE-2026-51990) in Sogou Input Method to deploy the GRAYRABBIT backdoor using a chained attack involving protocol handler injection and an outdated Chromium engine.
Security researcher Nightmare Eclipse disclosed a Microsoft Defender zero-day exploit named ShieldBreak that bypasses previous patches to grant SYSTEM privileges.
A Chinese-speaking operator uses the PEEP toolkit, a RedExt derivative, to transform Chromium browsers into persistent host-level backdoors via native-messaging bridges.
Suspected Silver Fox (Yinhu) threat actors are targeting Chinese-speaking users and multinational operations in China using high-fidelity spoofed vendor sites to deliver persistent implants like ValleyRAT.
BlackSuit ransomware operators conducted a 9-day intrusion starting with VPN brute-force attacks on non-MFA accounts, followed by lateral movement via RDP and data staging before enterprise-wide encryption.
The Armadin Attacker uses a new tool called PRTremote to hijack Entra ID Primary Refresh Tokens by executing scheduled tasks within interactive user sessions over SMB.
