Browse public community intelligence reports, source analysis, and threat research.
16 intel reports
An AppContainer with no capabilities can exploit a missing authorization check in Windows.UI.Storage.dll to hijack the ms-settings protocol and achieve SYSTEM privileges.
Microsoft Defender for Endpoint has introduced new token context fields in Advanced Hunting to surface privileged group SIDs and logon attributes at the time of token creation.
The ToddyCat APT group utilizes Umbrij malware to compromise corporate Gmail accounts by leveraging a technique called Shadow Token via Remote Debug (STRD) to steal OAuth tokens.
The Miasma worm campaign compromised 20 LeoPlatform npm packages and a Verana Blockchain Go module to deploy a Bun-based credential stealer targeting developer environments and CI/CD pipelines.
Makop ransomware utilizes AES+RSA encryption and aggressive anti-recovery techniques such as deleting volume shadow copies and backup catalogs to target diverse Windows environments.
The Vile Collective utilizes a Go-based ransomware that employs double extortion, HPKE-v1 encryption, and extensive anti-analysis techniques to target a wide range of global sectors.
