Browse public community intelligence reports, source analysis, and threat research.
128 intel reports
Affiliates of INC and The Gentlemen ransomware groups are using an AI-orchestrated infrastructure featuring the 'Phantom' autonomous red team framework to exploit edge devices and deploy ransomware.
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
Threat actors abuse Microsoft Teams external chat to pose as IT support, using email bombing and vishing to deploy remote access tools and malware.
An extensive phishing campaign impersonating the U.S. District Court targets over 100,000 companies using personalized lures to deliver the LodaRAT remote access trojan via malicious ISO files.
The threat actor UNG0002 is targeting academic institutions using macOS-style metadata folder structures to evade Windows security scanners and deliver Cobalt Strike via DLL sideloading.
Mustang Panda is targeting Southeast Asian diplomatic entities using new in-memory ZOHOMURK SOCKS5 tunnelers and MINIRECON automated reconnaissance tools deployed via DLL side-loading.
Midnight Blizzard-linked actor GTG-20006 utilized AI-assisted code generation to modify PowerShell stagers and Go backdoors targeting government and defense organizations via device-code phishing.
An unidentified threat actor utilizes renamed Python interpreters and custom ._pth files to execute malicious code without command-line arguments, eventually attempting to deploy ScreenConnect via a UAC bypass.
Star Blizzard (suspected Russian state-linked) is conducting spearphishing campaigns against Moldovan and Ukrainian civil society using password-protected VHDX files and WebDAV-based persistence.
Luna Moth (Silent Ransom Group) uses voice-based callback phishing to trick victims into installing legitimate RMM tools for data extortion without using encryption.
