Browse public community intelligence reports, source analysis, and threat research.
68 intel reports
An unidentified ransomware-related threat actor is using SloppyRAT, a new multi-stage malware, to establish network footholds via ClickFix lures and blockchain-based C2 resolution.
China-aligned actor FamousSparrow is targeting Latin American governments with SparroWocky, a sophisticated C++ backdoor featuring advanced anti-analysis and modular execution capabilities.
The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.
KATARU is a newly observed IoT malware family that utilizes Linux local privilege escalation exploits and encrypted C2 to conduct DDoS attacks.
Tanto Security demonstrated an unauthenticated RCE chain in Telerik UI for ASP.NET AJAX by exploiting an AES-CBC padding oracle to achieve arbitrary type resolution and DLL loading.
REVSTEALER is a comprehensive Windows infostealer using Polygon smart contracts for resilient C2 infrastructure and delivering specialized modules for crypto-mining and reverse proxying.
Russian-linked threat actor UAT-10820 utilizes ClearFake infection chains and WebDAV-hosted DLLs to deploy Amatera stealer and follow-on payloads like ZigCryptoStealer and NetSupport Manager.
DPRK-linked actors (Kimsuky, APT37, Lazarus) are using the Ted backdoor and CurlRAT framework to target South Korean media and automotive sectors for long-term espionage and watering-hole attacks.
The Exilware threat group uses the AI-driven BraZetsu Python framework to compromise Windows hosts and monetize access via the 'Infect Marketplace.'
Auto-Color is a Linux backdoor that uses a double-forking mechanism and an LD_PRELOAD-based rootkit (libcext.so.2) to hide files and network activity while communicating with a C2 server at 146.70.41.178.
