Browse public community intelligence reports, source analysis, and threat research.
169 intel reports
The UNK_DeadDrop threat actor targets developers with fake recruitment and code review phishing campaigns to deploy cross-platform malware for cryptocurrency theft.
The GreenBlood ransomware group utilizes a Go-based malware featuring military-grade encryption and double extortion tactics to target global organizations.
The Yuta/Solara campaign distributes a Python-based port of Glove Stealer targeting Roblox users and developers with advanced Chrome App-Bound Encryption bypasses.
DesckVB RAT operators utilize a multi-stage infection chain starting with malspam and legitimate domain redirection to deploy an in-memory .NET Trojan.
The Weedhack Malware-as-a-Service (MaaS) campaign targets Minecraft players with custom JAR files that deploy multi-stage infostealers and RATs using Ethereum-based C2 infrastructure.
SilentCryptoMiner and XMRig variants are being distributed through pirated movie and digital library sites using fake video player updates and DLL side-loading.
JS.MonoGlyphRAT is a persistent JScript backdoor targeting US technology, MSSP, and telecom sectors using monoglyph-obfuscated scripts and encrypted PowerShell stagers.
Cloud Atlas APT targets government and diplomatic entities in Russia and Belarus using a revamped toolset including VBCloud, PowerShower, and the new PowerCloud data exfiltration script.
The PhantomRaven actor is targeting DeFi, Cloud, and AI developers via 33 malicious NPM packages using a multi-stage Remote Dynamic Dependency chain to harvest credentials.
Lotus Wiper is a destructive malware campaign targeting the energy and utilities sector in Venezuela, using batch scripts and masqueraded binaries to wipe physical drives and delete system recovery mechanisms.
