Browse public community intelligence reports, source analysis, and threat research.
25 intel reports
China-linked APT41 (FishMonger) is using BlackX, a UEFI bootkit evolved from BlackLotus, to bypass Secure Boot and maintain persistence on diplomatic targets in Central Asia.
The Iranian Ministry of Intelligence and Security (MOIS) uses HEAVYGRAM (aka CHOSEN BRICK) malware to target dissidents and journalists via social engineering and Telegram-based command-and-control.
Iranian state cyber actors are using CHOSEN BRICK, a Windows-based spyware, to monitor dissidents and activists through social engineering and Telegram-based command and control.
The IronToll campaign utilizes the 'Iron Man System' PhaaS kit to conduct global government and brand impersonation for real-time credential and OTP theft.
DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.
SilkParasite is a China-nexus cyberespionage cluster targeting Central Asian government entities using a modular arsenal of seven RAT families, including five previously undocumented tools and AI-assisted tradecraft.
Threat actors use Microsoft Teams social engineering and Quick Assist to deploy a two-component relay and reverse shell via DLL sideloading and WMI execution.
A suspected China-nexus actor, designated SilkParasite, utilizes a modular ecosystem of seven RAT families to target government economic bodies in Central Asia via DLL sideloading and Google Drive-backed C2.
C2Looper is a new Rust-based backdoor likely linked to ransomware actors, utilizing GitHub for command-and-control and distributed via ClickFix campaigns.
China-based Jewelbug APT utilizes the XG-Web platform to conduct dual-mission operations involving government espionage across the Middle East and Asia alongside large-scale cryptocurrency fraud.
