Browse public community intelligence reports, source analysis, and threat research.
15 intel reports
Qilin (aka Agenda) is a high-volume Russian-speaking RaaS operation targeting global manufacturing and healthcare sectors through credential abuse and advanced EDR evasion.
Play (or Playcrypt) is a sophisticated ransomware group utilizing double extortion, custom information stealers like Grixba, and exploitation of vulnerabilities in FortiOS and Microsoft Exchange to target global organizations.
Longlegs (aka Storm-2603), a China-nexus threat actor, is deploying Warlock ransomware against critical infrastructure and government sectors by exploiting SharePoint 'ToolShell' vulnerabilities.
The PAYLOAD ransomware family hijacked Active Directory Group Policy Objects to deliver ransom notes and disable host security domain-wide without endpoint binaries.
A Chinese-speaking operator uses the PEEP toolkit, a RedExt derivative, to transform Chromium browsers into persistent host-level backdoors via native-messaging bridges.
The pro-Ukrainian threat actor Bearlyfy (Toy Ghouls) is targeting Russian organizations using their custom GenieLocker ransomware across Windows, Linux, and ESXi platforms.
An unknown threat actor deployed a new Rust-based ransomware called Spirals against a South Asian IT services company using web shell access and rapid lateral movement.
Attackers can abuse Active Directory Certificate Services (ADCS) to obtain trusted TLS certificates and hijack DNS to perform MITM attacks against Microsoft Entra ID logins.
The Gentlemen RaaS group is targeting critical infrastructure using custom Go-based backdoors and ransomware variants that leverage GPO deployment and Bring Your Own Vulnerable Driver (BYOVD) techniques.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
