Intel Exchange

Suspected Silver Fox actors are targeting Latin American banking and financial sectors using fake DocuSign and NFe tax lures to deliver a custom HVNC backdoor for persistent remote control.

Threat actors are exploiting ScreenConnect to deploy a four-stage VBScript chain that propagates across active remote sessions, ultimately delivering miners and backdoors.

The BlueKit threat actor group is conducting a sophisticated Phishing-as-a-Service campaign targeting financial sector CEOs using browser-in-the-middle techniques and post-authentication ScreenConnect delivery.

Threat actors are abusing the legitimate Faronics Deploy platform to execute malicious PowerShell scripts and establish persistent remote access via ScreenConnect.

The suspected APT29 group (Cloaked Ursa) launched the Spring Ring campaign targeting over 150 employees with Microsoft Teams-based voice phishing to deploy RMM tools and custom PowerShell RATs.

SynkLoader is a modular Windows malware family distributed via Microsoft Teams phishing that uses a bundled Python environment and in-memory components to facilitate credential theft, tunneling, and remote access.

The SysScan refund scam uses fraudulent Microsoft-branded security scans to deceive users into uninstalling antivirus software and providing remote access credentials.

Kimsuky targets South Korea and Japan using spear phishing to deploy LNK malware and abuse legitimate remote access tools like AnyDesk and Chrome Remote Desktop.

Lazarus Group's Famous Chollima unit utilizes stolen identities and AI-assisted workflows to infiltrate Western finance and technology firms as remote IT workers.

An Akira ransomware affiliate targeted a SonicWall VPN to exfiltrate data and attempted to bypass security controls by rebooting the victim host into Safe Mode.