Browse public community intelligence reports, source analysis, and threat research.
55 intel reports
The PoisonX threat actor utilizes a complex multi-stage attack chain involving DLL sideloading and vulnerable driver exploitation (BYOVD) to deploy a modular RAT with EDR-bypass capabilities.
Chinese-speaking threat actor lwxat operates a Malware-as-a-Service (MaaS) ecosystem centered on BadIIS, targeting web servers for SEO fraud and malicious redirection.
Kimsuky (APT43) is utilizing updated PebbleDash and AppleSeed malware variants, alongside legitimate tools like VSCode and DWAgent, to target South Korean defense and government entities.
The threat actor STAC6405 is conducting an ongoing phishing campaign targeting U.S. organizations with a dual-RMM architecture using SimpleHelp and ScreenConnect for persistent, silent access.
Multiple China-aligned threat actors, including Stately Taurus and clusters CL-STA-1048/1049, are targeting a Southeast Asian government using a diverse toolkit of USB-propagated malware, novel loaders, and remote access Trojans.
