Browse public community intelligence reports, source analysis, and threat research.
119 intel reports
KGB RAT is a Windows-based Malware-as-a-Service (MaaS) tool providing Remote Access Trojan capabilities, including credential theft, HVNC, ransomware, and cryptocurrency wallet swapping.
VulcanRAT207.B leverages RomulusLoader and signed VulkanInfo binaries to establish persistent remote access and kernel-level evasion on Windows systems.
The SleepyDuck operation leverages fake Solidity VS Code extensions and steganographic MP4 files to deliver evjawbreaker implants and ScreenConnect backdoors.
UNC7017 conducted ephemeral supply chain tampering against AOMEI Technology update servers to deliver CROSSROAD and SHINYROAD malware via short-burst configuration modifications.
WinLol is a multi-stage malware toolkit featuring a Rust dropper, an in-memory downloader, and a Go-based RAT that streams victim screens via WebRTC using DLL side-loading of legitimate OneDrive binaries.
Russia-aligned threat actor UAC-0099 has evolved its custom MATCHBOIL downloader with enhanced obfuscation, sandbox evasion, and timer-based payload delivery targeting Ukrainian sectors.
Earth Sirrush (UAC-0099) utilizes evolving .NET malware, steganographic delivery, and trojanized applications to target Ukrainian government and logistics sectors for long-term espionage.
Warden Stealer is a Rust-based Malware-as-a-Service that targets AI coding agent tokens, browser data, and cryptocurrency wallets through process injection and anti-VM techniques.
The Iranian state-aligned actor CL-STA-1178 is conducting the 'Blinder Tunnel' campaign targeting Iraqi critical infrastructure using trojanized coding challenges and living-off-the-cloud TTPs.
2CLoader is a sophisticated new malware loader identified in August 2026 that uses indirect system calls and environment spoofing to deliver information stealers like Vidar and Remus.
