Browse public community intelligence reports, source analysis, and threat research.
119 intel reports
LegionLoader uses a multi-stage infection chain involving MSI files, DLL sideloading, and Python-based components to achieve stealthy execution and C2 communication.
The Vile Collective utilizes a Go-based ransomware that employs double extortion, HPKE-v1 encryption, and extensive anti-analysis techniques to target a wide range of global sectors.
TrymeLocker (also known as RageCore) is a destructive .NET ransomware attributed to actor 'inwormmap' that implements aggressive persistence, system sabotage, and C2 via Telegram.
DRAYN is a sophisticated multi-stage stealer and loader malware that utilizes 7-Zip SFX archives for deployment and maintains persistent C2 via WebSockets.
The Sauron ransomware operation utilizes a multi-stage toolkit, including Telegram Bot API for data exfiltration and professional-grade system profiling for double extortion.
Pay2Key operators utilize a multi-stage execution chain involving polyglot scripts, DLL search order hijacking of Avast software, and destruction of system recovery options to deploy ransomware.
Liushen is a Python-based ransomware framework that utilizes process hollowing, MBR modification, and extensive anti-analysis techniques to encrypt victim data and inhibit recovery.
The Silver Fox threat actor targets Japanese and Chinese organizations using spear-phishing to deploy the modular 10FXRAT and the PoisonX kernel driver for security product bypass.
The Miasma threat actor compromised 56 npm packages to steal CI/CD secrets and deploy persistent backdoors using a novel binding.gyp execution trigger.
The suspected Chinese threat actor TA4922 is expanding globally, utilizing new loaders like RomulusLoader and SilentRunLoader alongside Atlas RAT to target organizations in Asia and Europe.
