Browse public community intelligence reports, source analysis, and threat research.
40 intel reports
IRGC-affiliated actors utilize GigaWiper, a modular Golang-based backdoor combining disk wiping, fake ransomware, and surveillance capabilities against Israeli targets.
China-nexus actor UAT-7810 is expanding its LapDogs Operational Relay Box network using new malware families like LONGLEASH and DOGLEASH to target networking and IoT devices.
China-nexus threat actors are exploiting public-facing phpMyAdmin panels via log poisoning to deploy Nezha monitoring agents and Ghost RAT malware.
StealC and Amadey operate as a coordinated Malware-as-a-Service ecosystem to harvest credentials and provide initial access for ransomware and espionage operations.
Lazarus group deployed a cluster of malicious npm packages masquerading as Rollup polyfill tools to target developer workstations with a multi-stage remote access and data-stealing payload.
TeamPCP and related campaigns are targeting GitHub Actions CI runners using malware like Megalodon and Miasma to harvest credentials and persist within development pipelines.
UNC5221 utilizes the SNOWLIGHT dropper to deploy VSHELL RAT, employing sophisticated evasion like direct syscalls and AMSI patching to compromise Windows systems.
The TAX#TRIDENT campaign utilizes fake Indian income tax assessment lures to deliver YTSCRat or unauthorized ManageEngine UEMS agents through various VBScript and ZIP-based infection paths.
Twill Typhoon is conducting a modular intrusion campaign in the APJ region using updated FDMTP backdoors and DLL sideloading via legitimate binaries like Sogou Pinyin and ClickOnce.
Threat actor Dr. Tube uses the Bissa Scanner and AI tools like Claude Code to exploit React2Shell vulnerabilities at scale, targeting financial and crypto sectors for secret harvesting.
