Browse public community intelligence reports, source analysis, and threat research.
10 intel reports
Unrelated threat actors are deploying the GSocket open-source tool on Linux servers to maintain persistent C2 access via the Global Socket Relay Network.
The CARBONATO botnet exploits unauthenticated Docker daemons to deploy an AI-driven Hermes Agent for automated post-exploitation and credential harvesting via Telegram.
The Atomic macOS Stealer (AMOS) campaign utilizes 'ClickFix' social engineering on Google Sites lures to trick users into executing malicious Terminal commands.
Adversaries are globally leveraging the ClickFix social engineering technique to trick Windows and macOS users into executing malicious terminal commands that deliver infostealers and RATs.
The 1337_GTWK Linux malware campaign utilizes a sophisticated two-stage infection chain featuring a kernel rootkit and a user-space Go agent to establish persistent control and evade detection.
Tengu is an evolved Mirai-derived IoT botnet featuring AEAD-encrypted C2, proxy capabilities, and aggressive self-defense mechanisms targeting Linux and Android systems.
Sophisticated threat actor UAT-8616 is targeting Cisco Catalyst SD-WAN components using zero-day vulnerabilities to gain root access and manipulate network fabric configurations.
RondoDox, TerraBot, and r00ts3c botnets are actively weaponizing legacy IoT vulnerabilities and modern enterprise flaws like Log4Shell using compromised residential infrastructure.
Cloud Atlas APT targets government and diplomatic entities in Russia and Belarus using a revamped toolset including VBCloud, PowerShower, and the new PowerCloud data exfiltration script.
North Korean actor Sapphire Sleet compromised the popular Axios npm package to deliver platform-specific RATs via a malicious dependency named plain-crypto-js.
