Browse public community intelligence reports, source analysis, and threat research.
137 intel reports
China-nexus actor UAT-7810 is expanding its LapDogs Operational Relay Box network using new malware families like LONGLEASH and DOGLEASH to target networking and IoT devices.
China-nexus threat actors are exploiting public-facing phpMyAdmin panels via log poisoning to deploy Nezha monitoring agents and Ghost RAT malware.
A threat actor compromised a Mastra maintainer account to poison 140+ npm packages with a malicious dependency used for cross-platform backdoors and credential exfiltration.
The Iranian threat actor Cavern Manticore is targeting Israeli IT providers and government sectors using the modular Cavern C2 framework and supply chain exploitation.
Void Dokkaebi targets software developers by injecting obfuscated JavaScript malware into configuration files like tailwind.config.js to establish command-and-control via blockchain APIs.
The ChocoPoC threat actor is targeting security researchers with trojanized GitHub PoC repositories that install malicious PyPI packages to deliver a Python-based RAT.
Remcos RAT is a sophisticated Windows remote access trojan used by actors like APT33 and UAC-0050 for extensive surveillance, credential theft, and full system control.
A customized variant of DcRAT named BeepRAT is being distributed via a Chinese phone number management utility, targeting telecommunications providers with an extensive C2 command framework.
Lazarus-linked North Korean actors are targeting software developers via hijacked npm/Go packages and fraudulent job interviews to deploy the InvisibleFerret infostealer.
Threat actors are exploiting CVE-2026-48558 in SimpleHelp RMM to deploy TaskWeaver, a modular Node.js loader, and Djinn Stealer, a cross-platform information stealer targeting developer and AI credentials.
