Browse public community intelligence reports, source analysis, and threat research.
242 intel reports
An unknown threat actor is infecting Magento e-commerce stores with scanner-evading JavaScript loaders via malicious CMS blocks to target shoppers.
WinLol is a multi-stage malware toolkit featuring a Rust dropper, an in-memory downloader, and a Go-based RAT that streams victim screens via WebRTC using DLL side-loading of legitimate OneDrive binaries.
An unidentified threat actor utilizes renamed Python interpreters and custom ._pth files to execute malicious code without command-line arguments, eventually attempting to deploy ScreenConnect via a UAC bypass.
A compromised version of the Tensorlake npm package (v0.5.144) distributes the Shai-Hulud worm to steal developer credentials and crypto-wallets while utilizing Ethereum smart contracts for C2 agility.
Chinese state-linked actors Flax Typhoon and Integrity Technology Group are exploiting a suite of legacy and modern vulnerabilities, including Apache Struts RCE, targeting critical infrastructure globally.
Threat actor marchos1as uploaded typosquatted AUR packages impersonating yay and paru to execute malicious scripts delivering the CHAOS remote access trojan.
Russia-aligned threat actor UAC-0099 has evolved its custom MATCHBOIL downloader with enhanced obfuscation, sandbox evasion, and timer-based payload delivery targeting Ukrainian sectors.
The Cl0p extortion operation has pivoted from traditional encryption-based ransomware to large-scale data theft via the exploitation of internet-facing Managed File Transfer (MFT) and enterprise software.
Earth Sirrush (UAC-0099) utilizes evolving .NET malware, steganographic delivery, and trojanized applications to target Ukrainian government and logistics sectors for long-term espionage.
Star Blizzard (suspected Russian state-linked) is conducting spearphishing campaigns against Moldovan and Ukrainian civil society using password-protected VHDX files and WebDAV-based persistence.
