Browse public community intelligence reports, source analysis, and threat research.
16 intel reports
The researcher Nightmare Eclipse (aka MSNightmare) has released multiple proof-of-concept exploits targeting Windows Defender, Kaspersky, Avast, CrowdStrike, and NVIDIA drivers to achieve local privilege escalation or denial-of-service.
Suspected Silver Fox (Yinhu) threat actors are targeting Chinese-speaking users and multinational operations in China using high-fidelity spoofed vendor sites to deliver persistent implants like ValleyRAT.
Stealer/1.0 is a hybrid malware designed to exfiltrate cloud, browser, and developer credentials via Discord webhooks before executing a highly destructive wiper routine that formats the C: drive.
Adversaries can weaponize the legitimate Microsoft-signed BTR.sys remediation driver to perform arbitrary file and registry deletions from Ring 0, bypassing EDR/AV protections.
HoneyMyte (Mustang Panda) has updated the CoolClient backdoor with a signed kernel-mode rootkit, msagent.sys, to hide and protect malicious artifacts on Windows systems.
The Payouts King actor targets corporate environments using Microsoft Teams vishing and Quick Assist to deploy a multi-variant Go-based backdoor named GoGRPC.
The NoEscape wiper is a destructive 'troll' malware that locks user interfaces, hijacks executable associations, and performs raw disk writes to disable systems.
An unprivileged user can exploit a logic flaw in the Windows Installer service to delete arbitrary folders as SYSTEM and subsequently execute code by planting malicious rollback scripts.
The Gentlemen RaaS group is targeting critical infrastructure using custom Go-based backdoors and ransomware variants that leverage GPO deployment and Bring Your Own Vulnerable Driver (BYOVD) techniques.
TrymeLocker (also known as RageCore) is a destructive .NET ransomware attributed to actor 'inwormmap' that implements aggressive persistence, system sabotage, and C2 via Telegram.
