Browse public community intelligence reports, source analysis, and threat research.
40 intel reports
The Cling botnet exploits multiple IoT vulnerabilities to deploy a worm-like malware that repurposes legitimate STUN traffic and infrastructure for command-and-control communications.
ClingSTUN is a Linux back-connect proxy backdoor that exploits numerous IoT vulnerabilities and abuses public STUN infrastructure for NAT traversal and remote command execution.
The CARBONATO botnet exploits unauthenticated Docker daemons to deploy an AI-driven Hermes Agent for automated post-exploitation and credential harvesting via Telegram.
An ongoing malicious npm campaign involving 'indexed-btree' and other packages bypasses lifecycle script defenses by burying loaders in runtime prototype methods and using Ethereum smart contracts for C2.
Adversary Pursuit Group identified ChainScript, a Node.js RAT that utilizes Polygon smart contracts for resilient C2 infrastructure rotation and delivery via ClickFix lures.
The Iranian Ministry of Intelligence and Security (MOIS) uses HEAVYGRAM (aka CHOSEN BRICK) malware to target dissidents and journalists via social engineering and Telegram-based command-and-control.
Konni, a DPRK-nexus actor, is targeting Ukrainian entities using socio-economic lures to deploy VelvetCake, a modular PowerShell-based task runner and reconnaissance tool.
The Gentlemen threat actor group is utilizing the cross-platform TukTuk C2 framework and BYOVD techniques to neutralize EDR solutions while targeting global technology and healthcare sectors.
Threat actors are actively exploiting CVE-2025-25249, a critical heap overflow in Fortinet's CAPWAP daemon, to deploy the PivotC2 remote access tool for network reconnaissance and lateral movement.
Kimsuky (APT-C-55) utilizes multi-stage PowerShell and C# malware delivered via disguised installers to target South Korean institutions for intelligence theft.
