Browse public community intelligence reports, source analysis, and threat research.
79 intel reports
Suspected Silver Fox actors are targeting Latin American banking and financial sectors using fake DocuSign and NFe tax lures to deliver a custom HVNC backdoor for persistent remote control.
The Hagaseca cluster uses THost9, a multi-stage Android RAT and ADB worm that leverages accessibility services and exposed ADB ports to infect physical and containerized Android environments.
Threat actors are exploiting ScreenConnect to deploy a four-stage VBScript chain that propagates across active remote sessions, ultimately delivering miners and backdoors.
SilkParasite is a China-nexus cyberespionage cluster targeting Central Asian government entities using a modular arsenal of seven RAT families, including five previously undocumented tools and AI-assisted tradecraft.
Attackers are abusing legitimate Microsoft device-code OAuth workflows via deceptive document-verification pages to steal access tokens and bypass MFA.
TWINLOOT is a modular Python implant using Microsoft SharePoint, Teams, and headless Edge browsers for stealthy command-and-control and lateral movement.
SLEEPWALKER is a sophisticated passive DLL backdoor targeting ERAAgent.exe that utilizes a custom bytecode command language and sniffs network traffic for magic trigger packets rather than beaconing.
Kimsuky targets South Korea and Japan using spear phishing to deploy LNK malware and abuse legitimate remote access tools like AnyDesk and Chrome Remote Desktop.
A suspected China-nexus actor, designated SilkParasite, utilizes a modular ecosystem of seven RAT families to target government economic bodies in Central Asia via DLL sideloading and Google Drive-backed C2.
The ToxicPanda 2.0 Android banking trojan has evolved with 167 remote commands, targeting 349 financial applications globally through advanced privilege escalation and overlay techniques.
