Browse public community intelligence reports, source analysis, and threat research.
76 intel reports
Lazarus Group's Famous Chollima unit utilizes stolen identities and AI-assisted workflows to infiltrate Western finance and technology firms as remote IT workers.
PurpleDelta, a North Korean IT worker group, uses AI-generated personas and identity brokering to secure remote technical roles for revenue generation and potential supply-chain compromise.
The cyber criminal group TeamPCP is conducting large-scale software supply chain attacks targeting DevOps and security tools to exfiltrate cloud credentials and secrets.
The Evooo1Bot and GorillaBot threat actors are deploying highly modular Mirai-based malware targeting Linux systems and IoT devices to execute large-scale DDoS attacks and establish persistent proxy relays.
Gray-market services like Poison Claude and Ecomagent exploit cloud promotional credits and synthetic identities to resell discounted, proxied access to frontier AI models.
Suspected Famous Chollima operatives infiltrated a decoy DeFi startup to gain access to corporate infrastructure, code, and financial assets using forged identities and remote access tools.
Russian-speaking operators are using custom platforms like camview and open-source scanners to exploit vulnerabilities in IP cameras and routers across Ukraine and Europe to build proxy networks.
The North Korean-linked threat actor Larva-26005 is targeting South Korean users by distributing the Xctdoor and XcLoader backdoors through spear phishing and installers disguised as legitimate security programs.
Cybercriminals are stealing AI API tokens using supply chain attacks and infostealers to fuel gray-market 'transfer station' proxy services, causing massive financial losses.
The SMOKE#SCREEN campaign utilizes diverse social engineering lures and aggressive security-dismantling toolsets to deploy persistent ScreenConnect RMM agents on Windows and macOS systems.
