Browse public community intelligence reports, source analysis, and threat research.
137 intel reports
The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.
PIVOTPIPE is a newly discovered .NET malware that reimplements Cobalt Strike Beacon features with custom evasion techniques, including AMSI bypassing and indirect syscalls.
Suspected Chinese threat actor Red Heron is exploiting CVE-2026-60004 in Gitea to deploy the JITTERLY implant and SIXZUT rootkit for source code theft and lateral movement.
Russia-aligned threat actor UAC-0099 is using the GuardBreaker technique to trip AI safety guardrails and blind automated malware analysis tools targeting Ukrainian critical infrastructure.
The IronToll campaign utilizes the 'Iron Man System' PhaaS kit to conduct global government and brand impersonation for real-time credential and OTP theft.
A maintainer compromise on the pub.dev platform led to the injection of malicious build-time scripts targeting developer credentials in the Flutter ecosystem.
A Chinese-speaking operator uses the PEEP toolkit, a RedExt derivative, to transform Chromium browsers into persistent host-level backdoors via native-messaging bridges.
Russian-speaking threat actors are exploiting a heap-based buffer overflow (CVE-2025-25249) in FortiGate devices to deploy PivotC2, an AI-assisted Node.js RAT for network tunneling and credential theft.
Suspected Silver Fox (Yinhu) threat actors are targeting Chinese-speaking users and multinational operations in China using high-fidelity spoofed vendor sites to deliver persistent implants like ValleyRAT.
The CL-CRI-1171 threat actor operates a mature Pay-Per-Install (PPI) marketplace that leverages SEO poisoning and trojanized YouTube gaming content to distribute OfferLoader and a variety of secondary payloads including Insomnia RAT and ARKTunnel.
