Browse public community intelligence reports, source analysis, and threat research.
16 intel reports
KGB RAT is a Windows-based Malware-as-a-Service (MaaS) tool providing Remote Access Trojan capabilities, including credential theft, HVNC, ransomware, and cryptocurrency wallet swapping.
Mustang Panda uses a diplomatic-themed OIC invitation LNK to deliver the PlugX RAT through multi-stage PowerShell execution and DLL side-loading.
Adversaries like SideCopy leverage tools such as Metasploit and Impacket to dump Active Directory's NTDS.dit and SYSTEM hives for full domain credential compromise.
A malicious LNK file disguised as an OIC invitation uses PowerShell to download an archive that installs PlugX via DLL side-loading through a Jarte-derived application.
Silver Fox threat actor is distributing the ValleyRAT backdoor by masquerading as signed adware applications to exfiltrate sensitive data from targets in China and India.
The Armadin Attacker uses a new tool called PRTremote to hijack Entra ID Primary Refresh Tokens by executing scheduled tasks within interactive user sessions over SMB.
Lazarus Group exploited a zero-day vulnerability in the Windows AppLocker driver (CVE-2024-21338) to deploy an updated FudModule rootkit for kernel-level security disruption.
Security researcher Chaotic Eclipse released a Windows Zero-Day PoC, LegacyHive, which enables arbitrary registry hive loading for privilege escalation across all supported Windows versions.
Anonymous researcher 'bikini' released Exploitarium, a repository containing over 30 proof-of-concept exploits for unpatched vulnerabilities across multiple software projects, including critical flaws in libssh2 and Gitea.
TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.
