Browse public community intelligence reports, source analysis, and threat research.
7 intel reports
China-nexus actor Fire Ant is compromising Cisco Nexus switches and IOS XR routers to harvest credentials and establish covert tunnels into critical infrastructure.
UNC5142 utilizes a Python-based RAT named DeviceManager, delivered via ClickFix campaigns, leveraging Ethereum smart contracts for resilient C2 infrastructure resolution and DNS for communication.
The SourTrade malvertising campaign uses victim browsers to locally assemble unique Windows executables from legitimate components and malicious bytecode to evade hash-based detection.
The HellCat ransomware group is increasingly exploiting Jira credentials harvested by infostealers like StealC and Amadey to facilitate corporate breaches and data exfiltration.
The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.
The PowMix botnet targets Czech organizations using compliance-themed phishing lures and sophisticated PowerShell-based in-memory execution.
Canis C2 is a previously undocumented cross-platform surveillance framework targeting Japanese users with sophisticated mobile agents and OS-specific fingerprinting.
