Browse public community intelligence reports, source analysis, and threat research.
97 intel reports
A sophisticated VBScript-based Java malware loader delivers Quima RAT by leveraging native Windows utilities for payload extraction and automated JRE installation.
Detection opportunities and rules for TAG-182's MarkiRAT campaign, covering fake VPN/media-player lures, BITS job abuse, svehost.exe masquerading, and typosquatted C2 infrastructure impersonating maj…
Threat actors are using vishing and Microsoft Teams screen-sharing to impersonate corporate IT support and deploy the blockchain-anchored EtherRAT malware.
Trojan FIXMAPI Loader is a reconnaissance stager delivered via trojanized Advanced Installer packages that impersonates Microsoft components to profile victims and beacon to C2 infrastructure.
UNC1549, an Iranian-linked APT, targets global aerospace and defense sectors using fake career portals to deliver custom malware including MiniJunk and MiniBrowse.
State-sponsored and cybercriminal actors are utilizing ClickFix Payload-as-a-Service (CPaaS) to deliver dynamically obfuscated malware via fake CAPTCHA social engineering and stealthy clipboard injection.
Remcos RAT is a sophisticated Windows remote access trojan used by actors like APT33 and UAC-0050 for extensive surveillance, credential theft, and full system control.
The Trum3it campaign utilizes a fake Polymarket arbitrage bot and 42 malicious npm packages to deliver an infostealer targeting DeFi developer credentials and crypto wallets.
The HellCat ransomware group is increasingly exploiting Jira credentials harvested by infostealers like StealC and Amadey to facilitate corporate breaches and data exfiltration.
The VEIL#DROP framework utilizes Google's Blogspot platform and living-off-the-land binaries to deploy the PureLog Stealer in memory via a multi-stage fileless chain.
