Browse public community intelligence reports, source analysis, and threat research.
24 intel reports
Storm-2945, a sub-cluster of Midnight Blizzard (APT29), is hijacking hospitality Wi-Fi networks to deliver CornFlake RAT and ChocoShell infostealer via DNS poisoning and fake update prompts.
Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.
TOKYOCORE is a sophisticated C++ malware combining ransomware, data theft, and hardware-destructive wiper capabilities, attributed to the actor @meds.
BlueNoroff is utilizing an advanced phishing kit to impersonate Zoom and Microsoft Teams, profiling cryptocurrency wallets before delivering tailored malware to high-value targets.
Salat Stealer, a Go-based information stealer, is distributed via gaming utilities like Xeno Executor to harvest credentials, crypto wallets, and perform live surveillance.
QuimaRAT is a cross-platform Java-based Remote Access Trojan sold as a service, targeting Windows, Linux, and macOS environments through modular encrypted plugins.
Remcos RAT is a sophisticated Windows remote access trojan used by actors like APT33 and UAC-0050 for extensive surveillance, credential theft, and full system control.
A customized variant of DcRAT named BeepRAT is being distributed via a Chinese phone number management utility, targeting telecommunications providers with an extensive C2 command framework.
A multi-stage steganographic loader campaign uses .NET-based binaries and bitmap objects to deploy payloads like Remcos RAT, Agent Tesla, and Red Line Stealer primarily targeting users in India.
The Drun Backdoor is a modular two-stage infostealer that utilizes the Chromelevator loader to inject into processes via direct syscalls, targeting browser credentials, session tokens, and gaming accounts.
