Browse public community intelligence reports, source analysis, and threat research.
68 intel reports
pyCodeV3 is a multi-stage Python loader using dynamic domain generation and pickle deserialization to execute arbitrary code from C2 servers.
Adversaries can bypass passwordless protections by exploiting Google’s Cloud Authenticator onboarding and recovery flows to extract master keys or forge authentication signatures.
PolinRider threat actors hijacked two Joyfill npm packages to distribute an obfuscated five-stage malware chain using blockchain-based C2 resolution and a Python credential stealer.
A sophisticated multi-stage campaign uses HijackLoader to deploy Vidar infostealers and the SnappyClient RAT via DLL side-loading and process hollowing.
Tengu is an evolved Mirai-derived IoT botnet featuring AEAD-encrypted C2, proxy capabilities, and aggressive self-defense mechanisms targeting Linux and Android systems.
Russia-aligned actors Earth Dahu and SHADOW-EARTH-066 are exploiting a WinRAR path traversal vulnerability to deploy GIFTEDCROOK and espionage modules against Ukrainian organizations.
The Astaroth (Guildma) banking trojan has integrated a new browser-automated WhatsApp Web spambot to propagate malware through trusted social contacts, primarily targeting Brazilian users.
The Chaos ransomware group is using a new Rust-based RAT called msaRAT that establishes covert C2 channels by hijacking headless Chrome and Edge browsers via the Chrome DevTools Protocol.
A new Windows infostealer called Dolphin X, sold by the actor Kontraktnik, uses AI-driven triage to prioritize high-value corporate and DevOps targets.
Stealth Falcon utilized an LLM-accelerated WebDAV delivery lab to deploy PureRAT via working directory hijacking and DLL sideloading targeting Mexican enterprise users.
