Browse public community intelligence reports, source analysis, and threat research.
15 intel reports
Earth Sirrush (UAC-0099) utilizes evolving .NET malware, steganographic delivery, and trojanized applications to target Ukrainian government and logistics sectors for long-term espionage.
The SideCopy APT is targeting Indian academic institutions using weaponized LNK files and mshta.exe to deploy ReverseRAT via fileless .NET deserialization.
Threat actors are leveraging compromised WordPress sites and blockchain smart contracts to deliver Amatera password stealers and WebRTC stagers through ClickFix lures.
Gamaredon, a Russian FSB-operated group, uses a multi-stage modular framework (GammaPhish, GammaLoad, GammaWorm, GammaSteel) to maintain persistent access and exfiltrate sensitive documents from Ukrainian government and critical infrastructure.
ACR Stealer (formerly Amatera Stealer) employs ClickFix social engineering, WebDAV delivery, and steganography to steal browser credentials and sensitive documents from Windows and macOS environments.
Russian-speaking threat actor UAT-11795 is utilizing ClickFix lures and trojanized software to deploy novel Python-based Starland RAT and PowerShell-based WLDR agent for cryptocurrency theft.
Rapid Brigantine and other cybercrime clusters are utilizing ClickFix social engineering to deploy modular loaders and backdoors including Potemkin, RMMProject, BabaDeda, and Lorem Ipsum.
An unidentified threat actor used ClickFix social engineering to deploy Potemkin Loader and RMMProject, moving laterally via SMBExec to distribute EtherRAT across 11 hosts.
Financially motivated actors like Vanilla Tempest are leveraging ClickFix social engineering to deliver modular loaders including BabaDeda, Lorem Ipsum, and Potemkin, ultimately deploying ransomware like Rhysida.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
