Browse public community intelligence reports, source analysis, and threat research.
363 intel reports
IRGC-affiliated actors utilize GigaWiper, a modular Golang-based backdoor combining disk wiping, fake ransomware, and surveillance capabilities against Israeli targets.
The threat actor Nightmare Eclipse released the RoguePlanet zero-day exploit (CVE-2026-50656) targeting a race condition in Microsoft Defender to achieve SYSTEM privileges on Windows 10 and 11.
UAT-7810, a China-nexus infrastructure specialist, builds Operational Relay Box (ORB) networks targeting SOHO and enterprise systems using the LEASH malware family for secondary espionage actors.
Silver Fox (UTG-Q-1000) distributors are deploying MODBEACON, a modular Rust-based implant using gRPC over HTTP/2 for C2 communication, targeting technology, education, and state-owned enterprises.
A China-nexus threat actor is targeting Indian taxpayers and government infrastructure using a multi-stage infection chain to deploy DcRAT via fake tax utility lures.
Adversaries use advanced sleep obfuscation techniques like Ekko and FOLIAGE to encrypt implants in-memory between callbacks, evading traditional YARA and memory attribute scanning.
UAT-7810, a China-nexus threat actor, is expanding its LapDogs Operational Relay Box (ORB) network by compromising networking devices using an updated suite of custom Linux and Java-based malware.
China-nexus actor UAT-7810 is expanding its LapDogs Operational Relay Box network using new malware families like LONGLEASH and DOGLEASH to target networking and IoT devices.
China-nexus threat actors are exploiting public-facing phpMyAdmin panels via log poisoning to deploy Nezha monitoring agents and Ghost RAT malware.
The Veil#Drop framework utilizes a multi-stage infection chain involving JavaScript launchers and PowerShell cradles hosted on Blogspot to deploy PureLog Stealer in memory.
