Browse public community intelligence reports, source analysis, and threat research.
53 intel reports
A suspected China-nexus actor, designated SilkParasite, utilizes a modular ecosystem of seven RAT families to target government economic bodies in Central Asia via DLL sideloading and Google Drive-backed C2.
ACRStealer campaign leverages a legitimate, Microsoft-signed Korean DLP driver (DCRCVDrv.sys) to perform kernel-context process termination for security software suppression.
Adversaries are globally leveraging the ClickFix social engineering technique to trick Windows and macOS users into executing malicious terminal commands that deliver infostealers and RATs.
The SMOKE#SCREEN campaign utilizes diverse social engineering lures and aggressive security-dismantling toolsets to deploy persistent ScreenConnect RMM agents on Windows and macOS systems.
Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.
JadeProx is a China-nexus threat cluster targeting Southeast Asia and Latin America using TriBack Loader and various tunneling tools for cyber espionage.
Russia-aligned threat group UAC-0099 is delivering a multi-stage infection chain involving LUNCHPOKE, BURNYBEAR, and MATCHBOIL.V2 by abusing legitimate Notepad++ plugin loading routines.
Threat actors are using multi-stage AutoIT scripts delivered via phishing to inject VIPKeylogger and MedusaHVNC into legitimate Windows processes like charmap.exe.
BlueNoroff is utilizing an advanced phishing kit to impersonate Zoom and Microsoft Teams, profiling cryptocurrency wallets before delivering tailored malware to high-value targets.
The JadeProx cluster, a China-nexus threat group, is using a custom 'TriBack Loader' to deliver AdaptixC2 and Beagle backdoors via DLL sideloading against targets in Southeast Asia and Latin America.
