Browse public community intelligence reports, source analysis, and threat research.
79 intel reports
The TeamPCP threat group is conducting a large-scale supply chain campaign using the 'Mini Shai-Hulud' worm to compromise npm packages, steal CI/CD and cloud credentials, and autonomously propagate.
The PoisonX threat actor utilizes a complex multi-stage attack chain involving DLL sideloading and vulnerable driver exploitation (BYOVD) to deploy a modular RAT with EDR-bypass capabilities.
Seedworm (MuddyWater) conducted a global espionage campaign in early 2026 using Node.js loaders and DLL sideloading to target manufacturing, government, and financial sectors.
An Iranian-nexus threat actor targeted 12 Omani government ministries using a custom C2 framework, ProxyShell exploits, and DotNetNuke vulnerabilities to exfiltrate judicial and citizen data.
The threat actor STAC6405 is conducting an ongoing phishing campaign targeting U.S. organizations with a dual-RMM architecture using SimpleHelp and ScreenConnect for persistent, silent access.
SERPENTINE#CLOUD has updated its delivery chain using ClickFix lures and Cloudflare tunnels to deploy a multi-RAT suite including Brute Ratel C4 and PureHVNC.
Aura Stealer is a sophisticated C++ info-stealer utilizing five obfuscation layers and Heaven's Gate techniques to target Chromium browsers and crypto wallets.
North Korean-linked EtherRAT utilizes 'EtherHiding' via Ethereum smart contracts to manage resilient C2 infrastructure for host fingerprinting and asset theft.
A sophisticated PureLog Stealer campaign uses localized copyright violation lures and a multi-stage, fileless execution chain to target multiple global sectors.
