Browse public community intelligence reports, source analysis, and threat research.
174 intel reports
A Russian-origin .NET remote access toolkit named CTRL uses weaponized LNK files to deploy modular payloads for credential theft, RDP session hijacking, and FRP-based reverse tunneling.
Aura Stealer is a sophisticated C++ info-stealer utilizing five obfuscation layers and Heaven's Gate techniques to target Chromium browsers and crypto wallets.
North Korean threat actor NICKEL ALLEY is targeting tech professionals via fake job interviews to deliver PyLangGhost RAT and BeaverTail malware through social engineering and malicious GitHub repositories.
Threat actor TeamPCP compromised the Trivy vulnerability scanner and associated GitHub Actions to exfiltrate cloud and CI/CD credentials via poisoned tags and binaries.
