Browse public community intelligence reports, source analysis, and threat research.
85 intel reports
The HellCat ransomware group is increasingly exploiting Jira credentials harvested by infostealers like StealC and Amadey to facilitate corporate breaches and data exfiltration.
The ROOTBOY actor is deploying Prinz Eugen, a technically deliberate Go-based ransomware that prioritizes fresh data and utilizes anti-forensics to evade detection.
Threat actors including BlackCat and STORM-0501 are leveraging native Azure features like Encryption Scopes and Customer-Provided Keys to encrypt and hold blob storage for ransom.
KongTuke and PS1Bot campaigns leverage malicious browser extensions and malvertising to deliver modular RATs and information stealers targeting Windows and macOS systems.
The MovieBox Android malware masquerades as a premium streaming service to perform advanced reconnaissance, data exfiltration, and UI overlay attacks.
The Gentlemen ransomware, operated by the Phantom Mantis group (LARVA-368), has evolved from a RaaS affiliate into an independent operation featuring AI-assisted development and a self-propagating worm module.
Makop ransomware utilizes AES+RSA encryption and aggressive anti-recovery techniques such as deleting volume shadow copies and backup catalogs to target diverse Windows environments.
LCRYX is a multifunctional VBS-based ransomware and worm that performs extensive registry tampering, security software termination, and network-wide self-propagation.
The Reynolds ransomware group utilizes the NSecKrnl kernel driver to terminate EDR processes and employs double-extortion tactics against enterprise targets.
A likely Iran-nexus activity cluster is deploying BLUERABBIT, a Golang-based backdoor that utilizes RabbitMQ, Redis, and MinIO for C2 and exfiltration prior to disk wiping and ransomware deployment.
