Browse public community intelligence reports, source analysis, and threat research.
68 intel reports
The NEBULA campaign utilizes seven malicious npm packages disguised as NebulaAI SDKs to deliver a customized KNTRAT remote-access trojan using stealthy syscall-based execution.
Russia-aligned threat actor UAC-0099 has evolved its custom MATCHBOIL downloader with enhanced obfuscation, sandbox evasion, and timer-based payload delivery targeting Ukrainian sectors.
2CLoader is a sophisticated new malware loader identified in August 2026 that uses indirect system calls and environment spoofing to deliver information stealers like Vidar and Remus.
China-nexus threat actors, including Storm-3069, utilize the modular NeedyMantis malware to maintain long-term access in telecommunications, government, and education sectors following initial compromise.
China-linked threat actor Storm-3069 uses NeedyMantis, a modular post-compromise framework, to maintain long-term access via DLL sideloading and custom encrypted archives.
An intrusion campaign utilizing SEO poisoning delivers PavokwiLoader and RMMCRAT, employing advanced obfuscation and environment gating to deploy Cobalt Strike beacons.
Sauron Loader is a novel Russian-language Malware-as-a-Service that utilizes social engineering, DLL side-loading, and in-memory decryption to deliver multi-stage payloads.
The Russian-aligned Lunex Malware-as-a-Service platform utilizes a complex four-stage attack chain, including BYOVD-based EDR neutralization, to deploy a sophisticated information stealer and C2 agent.
The researcher Nightmare Eclipse (aka MSNightmare) has released multiple proof-of-concept exploits targeting Windows Defender, Kaspersky, Avast, CrowdStrike, and NVIDIA drivers to achieve local privilege escalation or denial-of-service.
Unknown actors compromised MemTensor packages on npm and PyPI to deliver 'sckit', a Go-based worm designed for credential harvesting and self-propagation via CI/CD pipelines.
