Browse public community intelligence reports, source analysis, and threat research.
88 intel reports
StealC and Amadey operate as a coordinated Malware-as-a-Service ecosystem to harvest credentials and provide initial access for ransomware and espionage operations.
Cavern Manticore, an Iran-nexus APT group, utilizes a modular .NET C2 framework targeting Israeli government and IT sectors through RMM abuse and DLL sideloading.
The Iranian threat actor Cavern Manticore is targeting Israeli IT providers and government sectors using the modular Cavern C2 framework and supply chain exploitation.
Cavern Manticore, an Iran-nexus threat actor, targets Israeli government and IT sectors using a modular .NET C2 framework employing complex compilation formats as anti-analysis layers.
Remcos RAT is a sophisticated Windows remote access trojan used by actors like APT33 and UAC-0050 for extensive surveillance, credential theft, and full system control.
Akira ransomware actors utilized Bumblebee malware and AdaptixC2 via Bing SEO poisoning to gain initial access, move laterally, and exfiltrate over 75GB of data.
Threat actors are exploiting CVE-2026-48558 in SimpleHelp RMM software to deploy TaskWeaver and Djinn Stealer, targeting cloud, AI, and developer credentials across Windows, macOS, and Linux.
Lazarus-linked North Korean actors are targeting software developers via hijacked npm/Go packages and fraudulent job interviews to deploy the InvisibleFerret infostealer.
SystemBC is a Windows-based malware family used as a SOCKS5 proxy and persistent RAT by major ransomware groups to tunnel malicious traffic and execute payloads.
A campaign involving hijacked npm and Go packages uses malicious VS Code tasks to trigger a multi-stage infection chain involving blockchain dead drops, a socket.io backdoor, and a Python infostealer.
