Browse public community intelligence reports, source analysis, and threat research.
190 intel reports
LCRYX is a multifunctional VBS-based ransomware and worm that performs extensive registry tampering, security software termination, and network-wide self-propagation.
The Ethereum Loader is a sophisticated multi-stage malware that uses blockchain-based C2 communication and masquerades as VMware components to evade detection.
Phantom Stealer utilizes obfuscated VBScript droppers and .NET loaders with Telegram-based C2 infrastructure to exfiltrate browser credentials and system data.
Threat actors can abuse the Microsoft WinGet configure command and COM APIs to execute arbitrary PowerShell scripts via YAML files, bypassing standard process monitoring.
Chaotic Eclipse is leveraging zero-day vulnerabilities YellowKey and MiniPlasma to bypass BitLocker and achieve SYSTEM-level privilege escalation on Windows 11 and Server environments.
TrymeLocker (also known as RageCore) is a destructive .NET ransomware attributed to actor 'inwormmap' that implements aggressive persistence, system sabotage, and C2 via Telegram.
A multi-stage HTA-based loader uses VBScript and PowerShell to deploy the Lightlife RAT, targeting crypto wallets and establishing persistence via Russian infrastructure.
Latrodectus malware utilizes MSI installers and PowerShell droppers to establish persistence and C2 communication while masquerading as legitimate SentinelOne security software.
DRAYN is a sophisticated multi-stage stealer and loader malware that utilizes 7-Zip SFX archives for deployment and maintains persistent C2 via WebSockets.
Russia's FSB-operated Gamaredon group leverages a modular VBScript and PowerShell arsenal targeting Ukraine through advanced persistence and multi-stage loading techniques.
