Browse public community intelligence reports, source analysis, and threat research.
107 intel reports
A sophisticated multi-stage campaign uses HijackLoader to deploy Vidar infostealers and the SnappyClient RAT via DLL side-loading and process hollowing.
The Payouts King actor targets corporate environments using Microsoft Teams vishing and Quick Assist to deploy a multi-variant Go-based backdoor named GoGRPC.
Cl0p ransomware affiliates are exploiting a critical RCE vulnerability (CVE-2026-12569) in PTC Windchill and FlexPLM systems to deploy JSP webshells and exfiltrate data.
Threat actors are using Google Search Ads to deliver SilentMare and HollowMare malware via trojanized utility applications like PDF converters and ZIP tools.
Russia-aligned actors Earth Dahu and SHADOW-EARTH-066 are exploiting a WinRAR path traversal vulnerability to deploy GIFTEDCROOK and espionage modules against Ukrainian organizations.
Attackers are chaining a REST API batch-route confusion vulnerability (CVE-2026-63030) and a SQL injection (CVE-2026-60137) to achieve unauthenticated remote code execution on WordPress Core.
Apex Foundation is distributing a macOS infostealer via npm packages and a fake MCP server, targeting Web3 founders with an AI-advisor lure.
Kimsuky targeted South Korean groupware vendors to compromise downstream customers using new Gomir malware variants and credential harvesting techniques.
TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.
UNC-RAID-M8280 uses a cross-platform Rust loader to deploy a customized Sliver C2 implant via abused third-party cloud storage and Cloudflare Tunnel infrastructure.
