Browse public community intelligence reports, source analysis, and threat research.
53 intel reports
Blind Eagle (APT-C-36) is utilizing a modernized JC-46 AsyncRAT build featuring WNF process injection and a Chrome App-Bound Encryption bypass to target Latin American financial interests.
A sophisticated VBScript-based Java malware loader delivers Quima RAT by leveraging native Windows utilities for payload extraction and automated JRE installation.
Turla (Secret Blizzard) targets government and military entities globally using the custom STOCKSTAY and Kazuar backdoors, often leveraging hijacked infrastructure.
Banana RAT has evolved its execution chain and C2 infrastructure, transitioning from static ETW-themed paths to randomized persistence and WebSocket communication via Cloudflare.
Kimsuky (APT43) utilizes a multi-stage CHM-based execution chain to profile systems and selectively deliver follow-on PowerShell payloads to targeted hosts.
A widespread campaign uses typosquatted software sites and SEO poisoning to distribute ScreenConnect, which then drops AsyncRAT onto target systems.
The Russia-aligned Gamaredon group significantly updated its arsenal in 2025, deploying six new PowerShell tools and leveraging legitimate cloud services and tunnels to target Ukrainian military and government institutions.
A massive SEO-driven campaign uses over 90 localized domains to distribute malicious software archives that deploy ScreenConnect as a persistent backdoor for AsyncRAT infections.
A threat actor known as Poisson utilized Havoc C2 and Tailscale VPN to establish persistent, secondary access into French automotive and individual targets for credential theft.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
