Browse public community intelligence reports, source analysis, and threat research.
18 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
Everest is a sophisticated .NET-based ransomware that employs aggressive lateral movement, service termination, and process self-protection while targeting Windows environments.
A suspected China-based threat actor exploited file upload vulnerabilities in a recreation management platform to deploy webshells and steal payment card data.
TASK#STOMP uses a VBScript-orchestrated execution chain to deploy a multi-stage PowerShell backdoor focused on automated document exfiltration, credential theft, and remote access.
DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.
Chinese-speaking threat actor Gambling Goblin compromises Brazilian government web servers to deploy malicious Apache modules and a broad Linux toolkit for large-scale SEO manipulation and gambling fraud.
ClickLock is a macOS information stealer and backdoor that uses social engineering and process-killing loops to coerce users into surrendering administrative credentials.
Void Dokkaebi targets developers with fake job interviews to plant self-propagating malware and commit-tampering scripts in code repositories.
China-linked threat actor OP-512 is targeting Windows IIS servers with a custom ASPX/ASHX web shell framework and memory-only privilege escalation tools.
Threat actors are using Google Search Ads to deliver SilentMare and HollowMare malware via trojanized utility applications like PDF converters and ZIP tools.
