Browse public community intelligence reports, source analysis, and threat research.
88 intel reports
Kimsuky APT utilizes a multi-stage JScript loader to deploy the NUKESPED backdoor, targeting South Korean entities through social engineering lures.
A highly sophisticated multi-stage npm supply chain campaign targeting Red Hat and AI-related packages uses GitHub as an adaptive C2 to deploy the Shai-Hulud infostealer variant 'Miasma'.
JS.MonoGlyphRAT is a persistent JScript backdoor targeting US technology, MSSP, and telecom sectors using monoglyph-obfuscated scripts and encrypted PowerShell stagers.
A critical argument injection vulnerability in Gogs allows authenticated users to achieve RCE by injecting the --exec flag into git rebase during pull request operations.
Twill Typhoon is conducting a modular intrusion campaign in the APJ region using updated FDMTP backdoors and DLL sideloading via legitimate binaries like Sogou Pinyin and ClickOnce.
APT37 utilizes obfuscated LNK files and multi-stage batch scripts to deploy a Python-based remote access backdoor disguised as a .cat file.
DPRK-linked threat actors are targeting South Korean organizations using LNK files that execute multi-stage PowerShell scripts and abuse GitHub as a command-and-control infrastructure.
A South Asian financial institution was targeted by an emerging actor using BRUSHWORM, a modular backdoor with USB spreading capabilities, and BRUSHLOGGER, a side-loaded keylogger.
