Browse public community intelligence reports, source analysis, and threat research.
85 intel reports
The Kimsuky threat group is utilizing malicious Hangul (HWP) resume documents to deploy Quasar RAT and ultimately the Funhouse ransomware variant.
Akira ransomware affiliates utilize RDP for initial access, ProcDump for credential theft, and GOST tunnels for persistence before deploying Rclone for exfiltration and encrypting data.
IronChain is a destructive malware build packaged with PyInstaller that utilizes multiple kernel drivers for process termination and persistence while intentionally discarding encryption keys to prevent data recovery.
Longlegs (aka Storm-2603), a China-nexus threat actor, is deploying Warlock ransomware against critical infrastructure and government sectors by exploiting SharePoint 'ToolShell' vulnerabilities.
Everest is a sophisticated .NET-based ransomware that employs aggressive lateral movement, service termination, and process self-protection while targeting Windows environments.
Ransomware groups including CHAOS, Medusa, and Gunra are increasingly targeting radiology departments and healthcare providers using double-extortion and extortion-only tactics.
The North Korean WaterPlum group uses fake job interviews and malicious development tools to compromise IT professionals, stealing over $10.7 million in cryptocurrency.
Storm-2570 is a versatile ransomware affiliate utilizing consistent post-compromise tools like MeshAgent, ntdsutil, and s5cmd to deploy multiple ransomware families including Qilin and DragonForce.
INC Ransomware threat actors utilize Bring Your Own Vulnerable Driver (BYOVD) tactics and dual ransom notes to pressure victims after exfiltrating data via tools like MEGASync.
Threat actor Bratteam88 is distributing the Rust-based KRSID ransomware and Quasar RAT by compromising and updating fraudulent Home Trading System (HTS) applications.
