Browse public community intelligence reports, source analysis, and threat research.
10 intel reports
APT28 and MuddyWater utilize ClickFix variants to compromise organizations via social engineering, deploying multi-stage payloads including steganography and Python-based reverse tunnels for internal network pivoting.
CISA red teams achieved full domain compromise and sensitive system access in two organizations, highlighting risks in cloud identity permissions and Active Directory Certificate Services (ADCS).
China-aligned threat actor ITG27 (Mustang Panda) is targeting the Indian government and energy sector using updated Toneshell v10 and a new VNC-capable backdoor named Havencode.
Adversaries like Mirage Kitten and Cloud Atlas leverage Kerberoasting and DNS tunneling to bypass traditional security perimeters and exfiltrate data.
Russian-speaking actor UAT-11795 is targeting US and European users with trojanized installers for MobaXterm, WebEx, and Zoom to deploy the novel Starland RAT and WLDR PowerShell agent.
Threat actors are increasingly using LLMs to generate bespoke, functional malware and automate complex Active Directory enumeration, data exfiltration, and extortion workflows.
StrikeShark leverages custom SharkLoader malware via DLL sideloading and public-facing application exploits to deploy Cobalt Strike Beacons across diverse global sectors.
The ToddyCat APT group utilizes Umbrij malware to compromise corporate Gmail accounts by leveraging a technique called Shadow Token via Remote Debug (STRD) to steal OAuth tokens.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
UNC5142 utilizes EtherRAT and the AI-generated TukTuk framework to conduct data exfiltration and deploy The Gentlemen ransomware via decentralized and SaaS infrastructure.
