Browse public community intelligence reports, source analysis, and threat research.
107 intel reports
Chinese-speaking threat actor lwxat operates a Malware-as-a-Service (MaaS) ecosystem centered on BadIIS, targeting web servers for SEO fraud and malicious redirection.
GhostLock leverages standard Windows API calls to acquire exclusive handles on SMB shares, causing ransomware-like availability denial without encryption or file modifications.
Threat actors compromised the Axios npm package to deliver a multi-platform Remote Access Trojan (RAT) via the malicious dependency 'plain-crypto-js'.
Threat actors compromised the axios npm package to deliver a multi-stage, cross-platform Remote Access Trojan (RAT) via a malicious dependency named plain-crypto-js.
Threat actor TeamPCP compromised multiple @fairwords npm packages to deploy CanisterWorm, a self-propagating malware that steals cloud credentials, crypto wallets, and Chrome passwords.
The Kimsuky threat group is distributing complex Python-based backdoors and downloaders via multi-stage LNK files using scheduled tasks for persistence.
Attackers weaponized an unauthenticated RCE in Langflow within 20 hours of disclosure to exfiltrate credentials and deploy second-stage payloads.
