Browse public community intelligence reports, source analysis, and threat research.
363 intel reports
Mustang Panda targets Indian government and energy sectors using novel ZOHOMURK and MINIRECON implants delivered via DLL sideloading and cloud-based C2.
The Ousaban banking trojan utilizes geofenced phishing pages and steganography to target users in Spain and Portugal with remote access and credential theft capabilities.
Chinese-speaking threat actor CL-STA-1062 is targeting government and energy sectors in Southeast Asia using a custom .NET backdoor named TinyRCT.
The ShinyHunters extortion group is targeting Oracle PeopleSoft instances globally using a zero-day vulnerability (CVE-2026-35273) and credential spraying to steal data.
The Russia-linked Turla group is deploying STOCKSTAY, a multi-component .NET backdoor masquerading as benign utilities, to target government and military entities in Ukraine and Europe.
Threat actor abdrizak uses typosquatted npm packages like postcss-minify-selector-parser to deliver a multi-stage Windows RAT targeting developer environments.
Initial Access Broker Woodgnat (KongTuke) is deploying the Mistic and MLTBackdoor RATs via social engineering and compromised WordPress sites to sell network access to major ransomware affiliates.
A cryptocurrency-mining campaign exploits CVE-2026-33017, an unauthenticated RCE in Langflow, to deploy a Go-based miner with aggressive defense evasion and lateral movement capabilities.
Threat actors are weaponizing the OpenClaw AI agent ecosystem by publishing malicious skills on ClawHub that deliver infostealers and execute novel agentic financial fraud.
DPRK-aligned actors are deploying macOS.Gaslight, a Rust-based backdoor that utilizes prompt injection payloads to subvert LLM-assisted malware analysis pipelines.
