Browse public community intelligence reports, source analysis, and threat research.
363 intel reports
The Pakistan-aligned APT36 is deploying a new variant of the SHEETCREEP RAT using Google Sheets for C2 communication, targeting Indian diplomatic interests.
The MovieBox Android malware masquerades as a premium streaming service to perform advanced reconnaissance, data exfiltration, and UI overlay attacks.
Suspected Lazarus Group (DPRK) operators are using malicious VS Code extensions like jupyter-powerdev to deliver a multi-stage backdoor utilizing SharePoint for C2 and Roslyn for in-memory execution.
The Colombian Smugglers group and other actors utilize techniques like Device Code Phishing and SVG smuggling to deliver malware including rmrlx, vjw0rm, and UnixStealer.
OceanLotus (APT32) is leveraging SPECTRALVIPER in targeted supply-chain attacks against Vietnamese stock investors and infrastructure corporations to support domestic surveillance.
A sophisticated multi-stage batch dropper uses PowerShell and VBScript to execute obfuscated payloads, perform DLL hijacking, and establish redundant C2 communications.
UNC6240 (ShinyHunters) exploited CVE-2026-35273 as a zero-day to target Oracle PeopleSoft infrastructure, primarily in the higher education sector, for data exfiltration and extortion.
The suspected Muddywater (APT28 variant) actor is deploying the Moodleuni C2 RAT using a fake Inno Setup installer to establish persistence via COM registration and startup shortcuts.
Makop ransomware utilizes AES+RSA encryption and aggressive anti-recovery techniques such as deleting volume shadow copies and backup catalogs to target diverse Windows environments.
The Ethereum Loader is a sophisticated multi-stage malware that uses blockchain-based C2 communication and masquerades as VMware components to evade detection.
