Browse public community intelligence reports, source analysis, and threat research.
157 intel reports
Lazarus-linked North Korean actors are targeting software developers via hijacked npm/Go packages and fraudulent job interviews to deploy the InvisibleFerret infostealer.
The HellCat ransomware group is increasingly exploiting Jira credentials harvested by infostealers like StealC and Amadey to facilitate corporate breaches and data exfiltration.
The ToddyCat APT group utilizes Umbrij malware to compromise corporate Gmail accounts by leveraging a technique called Shadow Token via Remote Debug (STRD) to steal OAuth tokens.
The Ousaban banking trojan utilizes geofenced phishing pages and steganography to target users in Spain and Portugal with remote access and credential theft capabilities.
Chinese-speaking threat actor CL-STA-1062 is targeting government and energy sectors in Southeast Asia using a custom .NET backdoor named TinyRCT.
The Russia-linked Turla group is deploying STOCKSTAY, a multi-component .NET backdoor masquerading as benign utilities, to target government and military entities in Ukraine and Europe.
The MYRA Linux RAT, distributed via the npm package 'apintergrationpost', utilizes a native C rootkit and fileless execution for persistent system access.
A multi-stage steganographic loader campaign uses .NET-based binaries and bitmap objects to deploy payloads like Remcos RAT, Agent Tesla, and Red Line Stealer primarily targeting users in India.
The Drun Backdoor is a modular two-stage infostealer that utilizes the Chromelevator loader to inject into processes via direct syscalls, targeting browser credentials, session tokens, and gaming accounts.
Dropping Elephant is using a China-themed decoy document to deliver a heavily reworked, in-memory RAT via DLL side-loading and Donut shellcode.
