Browse public community intelligence reports, source analysis, and threat research.
88 intel reports
Lucid Stealer is a Node.js-based information stealer and RAT that uses Single Executable Application packaging to deliver modular payloads for credential theft and remote control.
Abyssos is a new modular C++ RAT utilizing LLVM-based obfuscation and a custom TCP protocol to perform credential theft, remote access via VNC, and network reconnaissance.
A threat group named Motions Vics is conducting a global banking phishing campaign using Telegram bots for credential exfiltration and AnyDesk for remote access.
The SMOKE#SCREEN campaign utilizes diverse social engineering lures and aggressive security-dismantling toolsets to deploy persistent ScreenConnect RMM agents on Windows and macOS systems.
UNC6692 uses email bombing and IT impersonation via Microsoft Teams to deploy the Edgecution/SNOW malware suite and facilitate ransomware access.
The threat actor STAC4749 uses Microsoft Teams vishing to impersonate IT support, gaining remote access to deploy custom loaders, backdoors, and Chaos ransomware targeting North American organizations.
Attackers are using cloned greeting-card templates with globally rewritten anchors to deliver ScreenConnect remote-access installers targeting healthcare data-protection roles.
Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.
Threat actors are deploying the NetSupport Manager RAT through a multi-stage chain involving phishing PDFs and obfuscated JavaScript to disguise legitimate binaries in a 'Stereo' folder.
Threat actor UAT-11764 and ransomware groups Sinobi and Warlock are weaponizing QR phishing and legitimate RMM tools like MeshAgent to bypass MFA and maintain persistent access.
