Browse public community intelligence reports, source analysis, and threat research.
14 intel reports
Russia's FSB-operated Gamaredon group leverages a modular VBScript and PowerShell arsenal targeting Ukraine through advanced persistence and multi-stage loading techniques.
CountLoader uses multi-stage PowerShell and JavaScript execution via mshta.exe to deploy a cryptocurrency clipper that redirects transactions by hijacking clipboard data.
Multiple China-aligned threat actors, including Stately Taurus and clusters CL-STA-1048/1049, are targeting a Southeast Asian government using a diverse toolkit of USB-propagated malware, novel loaders, and remote access Trojans.
A South Asian financial institution was targeted by an emerging actor using BRUSHWORM, a modular backdoor with USB spreading capabilities, and BRUSHLOGGER, a side-loaded keylogger.
