Browse public community intelligence reports, source analysis, and threat research.
15 intel reports
The VEIL#DROP framework utilizes Google's Blogspot platform and living-off-the-land binaries to deploy the PureLog Stealer in memory via a multi-stage fileless chain.
SilverFox actors are utilizing a multi-stage loader chain masquerading as Panasonic and Philips software to deploy Sauron/Gh0stRAT backdoors via Alibaba OSS infrastructure.
Threat actors can abuse the Microsoft WinGet configure command and COM APIs to execute arbitrary PowerShell scripts via YAML files, bypassing standard process monitoring.
DarkWatchman is a sophisticated, fileless JavaScript-based RAT that uses C# keyloggers and registry-based persistence to evade detection.
APT37 utilizes obfuscated LNK files and multi-stage batch scripts to deploy a Python-based remote access backdoor disguised as a .cat file.
