Browse public community intelligence reports, source analysis, and threat research.
363 intel reports
Turla (Secret Blizzard) targets government and military entities globally using the custom STOCKSTAY and Kazuar backdoors, often leveraging hijacked infrastructure.
StealC and Amadey operate as a coordinated Malware-as-a-Service ecosystem to harvest credentials and provide initial access for ransomware and espionage operations.
Trojan FIXMAPI Loader is a reconnaissance stager delivered via trojanized Advanced Installer packages that impersonates Microsoft components to profile victims and beacon to C2 infrastructure.
Banana RAT has evolved its execution chain and C2 infrastructure, transitioning from static ETW-themed paths to randomized persistence and WebSocket communication via Cloudflare.
The REF6045 activity cluster uses ClickFix social engineering to deploy SCMBANKER, a PowerShell toolkit designed for banking fraud targeting Mexican financial institutions.
Kimsuky (APT43) utilizes a multi-stage CHM-based execution chain to profile systems and selectively deliver follow-on PowerShell payloads to targeted hosts.
A high-ca pability . NET-based infosteale r targetin g multiple browsers, Discord t okens, an d system f ingerprint s while by passing Ch rome App-B ound Encry ption via DLL inject ion.
State-sponsored and cybercriminal actors are utilizing ClickFix Payload-as-a-Service (CPaaS) to deliver dynamically obfuscated malware via fake CAPTCHA social engineering and stealthy clipboard injection.
The ChocoPoC threat actor is targeting security researchers with trojanized GitHub PoC repositories that install malicious PyPI packages to deliver a Python-based RAT.
Lazarus group deployed a cluster of malicious npm packages masquerading as Rollup polyfill tools to target developer workstations with a multi-stage remote access and data-stealing payload.
