Browse public community intelligence reports, source analysis, and threat research.
65 intel reports
An Italian phishing campaign uses DLL side-loading and Chrome Native Messaging to escape the browser sandbox and execute remote PowerShell commands.
Initial Access Broker Woodgnat (KongTuke) is deploying the Mistic and MLTBackdoor RATs via social engineering and compromised WordPress sites to sell network access to major ransomware affiliates.
Threat actors can abuse Windows Quality of Service (QoS) policies via PowerShell or WMI to throttle EDR agent outbound bandwidth to near zero, effectively silencing cloud-based telemetry.
The EDRChoker tool abuses Windows Policy-Based Quality of Service (QoS) to starve security agents of bandwidth, causing them to silently time out without generating network block artifacts.
LCRYX is a multifunctional VBS-based ransomware and worm that performs extensive registry tampering, security software termination, and network-wide self-propagation.
Threat actors use PowerShell scripts to bypass standard process monitoring, but defenders can leverage the DeviceEvents table in Microsoft Defender XDR to gain visibility into individual command executions.
A likely Iran-nexus activity cluster is deploying BLUERABBIT, a Golang-based backdoor that utilizes RabbitMQ, Redis, and MinIO for C2 and exfiltration prior to disk wiping and ransomware deployment.
Russia's FSB-operated Gamaredon group leverages a modular VBScript and PowerShell arsenal targeting Ukraine through advanced persistence and multi-stage loading techniques.
The TAX#TRIDENT campaign utilizes fake Indian income tax assessment lures to deliver YTSCRat or unauthorized ManageEngine UEMS agents through various VBScript and ZIP-based infection paths.
Kernel-level anti-cheat systems utilize deep OS integration and rootkit-like behaviors to counter sophisticated threats including DMA hardware, BYOVD attacks, and hypervisor-based cheats.
