Browse public community intelligence reports, source analysis, and threat research.
38 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
A ClickFix campaign utilizes EtherHiding via BSC testnet contracts to deliver multi-stage PowerShell loaders that inject shellcode into MicrosoftEdgeUpdate.exe.
Threat actors including Stardust Chollima and Sandworm are utilizing 'Browser Cache Smuggling' to deliver malware like Vidar Stealer and GeniexRAT by pre-fetching payloads into browser caches to bypass security scans and character limits.
Attackers are weaponizing AI coding agents by placing malicious AGENTS.md instruction files in common directories to coerce the agents into installing rogue npm packages and executing arbitrary commands.
CastleStealer and CastleLoader use browser protection bypasses and ClickFix social engineering to exfiltrate sensitive data and deploy secondary RATs like NetSupport.
ClickFix attackers use social engineering to trick users into pasting malicious commands into their OS, bypassing browser-based download protections to deliver infostealers and RATs.
Threat actors associated with Vice Society are utilizing ClickFix social engineering to deploy Lorem Ipsum Loader and Python-based tunnels for network access.
An unidentified threat actor utilizes renamed Python interpreters and custom ._pth files to execute malicious code without command-line arguments, eventually attempting to deploy ScreenConnect via a UAC bypass.
AvisLoader is a Windows malware loader that utilizes the Tox peer-to-peer messaging protocol for resilient command-and-control and is delivered via ClickFix social engineering lures.
