Browse public community intelligence reports, source analysis, and threat research.
59 intel reports
China-nexus threat actors are targeting Myanmar government personnel using a VHD-delivered Golang backdoor named QUICAgent that utilizes QUIC protocol for C2 communication.
ACRStealer campaign leverages a legitimate, Microsoft-signed Korean DLP driver (DCRCVDrv.sys) to perform kernel-context process termination for security software suppression.
Adversaries are globally leveraging the ClickFix social engineering technique to trick Windows and macOS users into executing malicious terminal commands that deliver infostealers and RATs.
Armored Likho (Eagle Werewolf) is utilizing a new Rust-based 'Still Toolkit' to steal Telegram session data and conduct covert audio surveillance against targets in Russia.
Russian-linked DOUBLECUP Loader-as-a-Service facilitates ClickFix campaigns delivering CountLoader and a new blockchain-resolving RAT named DeviceManager.
PolinRider threat actors hijacked two Joyfill npm packages to distribute an obfuscated five-stage malware chain using blockchain-based C2 resolution and a Python credential stealer.
A sophisticated multi-stage campaign uses HijackLoader to deploy Vidar infostealers and the SnappyClient RAT via DLL side-loading and process hollowing.
EtherHiding malware on macOS uses Polygon smart contracts as dead-drop resolvers for C2 domain rotation to evade traditional sinkholing and detection.
ACR Stealer (formerly Amatera Stealer) employs ClickFix social engineering, WebDAV delivery, and steganography to steal browser credentials and sensitive documents from Windows and macOS environments.
Egyptian threat actor codemado and associates leverage custom Evilginx forks and Device Code Flow abuse to target Microsoft 365 and cryptocurrency users.
