Browse public community intelligence reports, source analysis, and threat research.
45 intel reports
China-aligned actor SHADOW-EARTH-053 targets government and defense sectors in Asia using DLL sideloading, multiple tunneling tools, and exploitation of CVE-2025-55182.
Threat actors including GOLD ENCOUNTER and campaigns STAC4713/STAC3725 are abusing QEMU virtualization to hide backdoors and deploy PayoutsKing and 3AM ransomware.
A Russian-origin .NET remote access toolkit named CTRL uses weaponized LNK files to deploy modular payloads for credential theft, RDP session hijacking, and FRP-based reverse tunneling.
A vulnerability chain in Azure Arc for Windows allows low-privileged users to hijack service communications, escalate to SYSTEM and take over the machine's Azure cloud identity.
Microsoft Defender blocked a large-scale human-operated ransomware attack that attempted to weaponize Group Policy Objects (GPOs) for security tampering and automated payload distribution.
