Browse public community intelligence reports, source analysis, and threat research.
64 intel reports
The Miasma threat actor group has expanded its supply chain campaign with 23 new malicious PyPI packages targeting bioinformatics and AI developers through trojanized native extensions and split-payload loaders.
UNC5221 utilizes the SNOWLIGHT dropper to deploy VSHELL RAT, employing sophisticated evasion like direct syscalls and AMSI patching to compromise Windows systems.
Hannibal Stealer is a sophisticated .NET-based information harvester and cryptocurrency stealer that utilizes DLL injection, Telegram-based C2, and clipboard hijacking to target browser data, VPN configurations, and crypto wallets.
DesckVB RAT operators utilize a multi-stage infection chain starting with malspam and legitimate domain redirection to deploy an in-memory .NET Trojan.
The Iran-nexus group Screening Serpens is targeting technology, aerospace, and defense professionals in the US, Israel, and UAE using advanced AppDomainManager hijacking and new RAT variants.
A new malware campaign dubbed Argamal targets players of adult games using trojanized installers to deliver a full-featured Remote Access Trojan (RAT).
The threat actor JINX-0164 targets cryptocurrency industry developers using sophisticated macOS-specific malware, CI/CD compromise, and social engineering to steal digital assets and credentials.
Threat actor UNG0002 is targeting Chinese universities using spear-phishing lures related to national fitness standards to deliver Cobalt Strike via DLL side-loading.
The Phorpiex-linked Needle MaaS platform utilizes a modular Rust-based agent and browser spoofers to steal cryptocurrency seed phrases from over 1,900 victims.
Deep#Door is a sophisticated Python-based Remote Access Trojan (RAT) that uses self-referential batch scripts for deployment and leverages the bore[.]pub tunneling service for stealthy C2 communications.
