Browse public community intelligence reports, source analysis, and threat research.
14 intel reports
Gryxa is a highly persistent, AI-developed toolkit used by financially motivated actors to steal credentials and maintain durable access via extensive recovery mechanisms.
China-based threat actors are deploying RatHat, a sophisticated Android Trojan that leverages generative AI for UI automation and ADB self-pairing for persistent shell access.
Threat actors are targeting internet-exposed MSSQL servers via SA account brute forcing to deploy XMRig miners using xp_cmdshell and multi-layered persistence.
The Go-based ClosedQuorum malware utilizes multiple commercial AI models to autonomously select post-compromise actions, including credential dumping and process injection, without human operator intervention.
An unidentified threat actor deployed a custom 12 KB Windows backdoor that hides its C2 domain using unary-encoded whitespace within a spoofed desktop.ini file.
Russian-linked DOUBLECUP Loader-as-a-Service facilitates ClickFix campaigns delivering CountLoader and a new blockchain-resolving RAT named DeviceManager.
TOKYOCORE is a sophisticated C++ malware combining ransomware, data theft, and hardware-destructive wiper capabilities, attributed to the actor @meds.
Stealth Falcon utilized an LLM-accelerated WebDAV delivery lab to deploy PureRAT via working directory hijacking and DLL sideloading targeting Mexican enterprise users.
The China-linked threat actor Silver Fox (UTG-Q-1000) is utilizing SEO poisoning and counterfeit installers to deliver a modular Rust-based RAT called MODBEACON featuring gRPC-encrypted communications.
Silver Fox (UTG-Q-1000) distributors are deploying MODBEACON, a modular Rust-based implant using gRPC over HTTP/2 for C2 communication, targeting technology, education, and state-owned enterprises.
