Browse public community intelligence reports, source analysis, and threat research.
242 intel reports
DarkCore is a remote access trojan (RAT) that uses a dedicated browser to reuse stolen sessions and route traffic through victims' IP addresses to bypass MFA and security controls.
The SleepyDuck operation leverages fake Solidity VS Code extensions and steganographic MP4 files to deliver evjawbreaker implants and ScreenConnect backdoors.
ClickFix attackers use social engineering to trick users into pasting malicious commands into their OS, bypassing browser-based download protections to deliver infostealers and RATs.
Flax Typhoon and RedTail botnet operators are repurposing legacy infrastructure to target newer vulnerabilities like XWiki and PHP-CGI across worldwide organizations.
Adversaries, including activity sharing infrastructure history with APT29, are exploiting CVE-2026-42589 in Gotenberg to deploy the 'cache_base' Go-based reverse shell and a broader toolkit.
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
Kimsuky (APT-C-55) utilizes phishing emails with malicious LNK files and supply-chain poisoning of the 'pybroker' library to steal sensitive data from financial and research sectors.
CrocoRat is a Python-based remote access trojan and cryptocurrency stealer delivered via ClickFix social engineering and novel DNS TXT record payload staging.
Threat actors are abusing legitimate Microsoft Power BI domains to host phishing lures that deliver multiple rogue ScreenConnect instances for persistent remote access.
Midnight Blizzard-linked actor GTG-20006 utilized AI-assisted code generation to modify PowerShell stagers and Go backdoors targeting government and defense organizations via device-code phishing.
