Browse public community intelligence reports, source analysis, and threat research.
14 intel reports
SafePay ransomware actors target global critical infrastructure by exploiting edge device vulnerabilities and using legitimate administrative tools for data exfiltration and hybrid encryption.
Threat actors are targeting internet-exposed MSSQL servers via SA account brute forcing to deploy XMRig miners using xp_cmdshell and multi-layered persistence.
ARToken is a Phishing-as-a-Service platform that abuses Microsoft's OAuth 2.0 device code flow to bypass MFA and achieve full Entra tenant takeover.
PIVOTPIPE is a newly discovered .NET malware that reimplements Cobalt Strike Beacon features with custom evasion techniques, including AMSI bypassing and indirect syscalls.
An unattributed threat cluster with similarities to SilverFox is targeting Cambodian organizations using a multi-stage infection chain that leverages BYOVD techniques and PNG-based shellcode to deploy SparkRAT.
China-aligned threat actor ITG27 (Mustang Panda) is targeting the Indian government and energy sector using updated Toneshell v10 and a new VNC-capable backdoor named Havencode.
Blind Eagle (APT-C-36) is utilizing a modernized JC-46 AsyncRAT build featuring WNF process injection and a Chrome App-Bound Encryption bypass to target Latin American financial interests.
TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.
Salat Stealer, a Go-based information stealer, is distributed via gaming utilities like Xeno Executor to harvest credentials, crypto wallets, and perform live surveillance.
The ToddyCat APT group utilizes Umbrij malware to compromise corporate Gmail accounts by leveraging a technique called Shadow Token via Remote Debug (STRD) to steal OAuth tokens.
