Browse public community intelligence reports, source analysis, and threat research.
7 intel reports
A Russian-speaking threat actor uses XaocMail phishing and ClickFix lures to deploy the Phantom53 DoH framework and Havoc post-exploitation agents.
Russian-speaking actors NyashTeam and Kapchenka operate Salat Stealer (WEB_RAT), a Go-based MaaS targeting Windows for credential and cryptocurrency theft.
Adversaries are deploying modular Linux implants including BPFDoor, Rekoobe, and the new AVERAT RAT against telecom edge appliances, utilizing SMTP-disguised C2 and BPF packet filtering to evade detection.
China-nexus actors UAT-11587 and UNC6384 are targeting government, diplomatic, and policy organizations across Asia and Europe using the novel Rust-based Antino backdoor and PlugX RAT via complex multi-stage infection chains.
TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.
A customized variant of DcRAT named BeepRAT is being distributed via a Chinese phone number management utility, targeting telecommunications providers with an extensive C2 command framework.
MariaDB 11.4 and 11.8 series are vulnerable to a heap buffer overflow in the JSON_SCHEMA_VALID function, allowing authenticated users to escalate privileges and execute arbitrary OS commands.
