Browse public community intelligence reports, source analysis, and threat research.
134 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
The NEBULA campaign utilizes seven malicious npm packages disguised as NebulaAI SDKs to deliver a customized KNTRAT remote-access trojan using stealthy syscall-based execution.
Attackers deploy Remcos as a remote access tool to maintain persistent control, execute commands, and steal data from Windows systems.
AvisLoader is a Windows malware loader that utilizes the Tox peer-to-peer messaging protocol for resilient command-and-control and is delivered via ClickFix social engineering lures.
Lazarus Group targets global financial services and cryptocurrency sectors using supply chain compromises and trojanized software to fund the North Korean regime.
The GlowComa threat actor is distributing ICMacOS, a macOS-targeted Malware-as-a-Service that has evolved from an information stealer into a persistent Remote Access Trojan (RAT).
The Cling botnet exploits multiple IoT vulnerabilities to deploy a worm-like malware that repurposes legitimate STUN traffic and infrastructure for command-and-control communications.
The Iranian state-aligned actor CL-STA-1178 is conducting the 'Blinder Tunnel' campaign targeting Iraqi critical infrastructure using trojanized coding challenges and living-off-the-cloud TTPs.
DragonForce ransomware group is utilizing legitimate Microsoft Teams TURN servers and MQTT brokers for redundant, stealthy C2 communication.
An operator identified as Zaib Ali uses a massive npm typosquatting campaign to discover infrastructure and a custom FastAPI framework called VHX Harvester to hijack GPU resources on the vast.ai marketplace.
