Browse public community intelligence reports, source analysis, and threat research.
190 intel reports
Gamaredon, a Russian FSB-operated group, uses a multi-stage modular framework (GammaPhish, GammaLoad, GammaWorm, GammaSteel) to maintain persistent access and exfiltrate sensitive documents from Ukrainian government and critical infrastructure.
Threat actors use Microsoft Teams social engineering and Quick Assist to deploy a two-component relay and reverse shell via DLL sideloading and WMI execution.
Silver Fox threat actor is distributing the ValleyRAT backdoor by masquerading as signed adware applications to exfiltrate sensitive data from targets in China and India.
TWINLOOT is a modular Python implant using Microsoft SharePoint, Teams, and headless Edge browsers for stealthy command-and-control and lateral movement.
The NinjaMare campaign uses typosquatted domains and MSIX installers to deliver a remote-controlled input injection engine disguised as a privacy browser.
Stealer/1.0 is a hybrid malware designed to exfiltrate cloud, browser, and developer credentials via Discord webhooks before executing a highly destructive wiper routine that formats the C: drive.
Mirage Kitten targets aviation and FinTech sectors in the Middle East and Africa using cross-platform Node.js and JavaScript RATs delivered via trojanized coding challenges.
BREEZE COMET targets Brazilian financial services and payment systems like Pix using a custom multi-language malware suite and AI-accelerated tradecraft.
Chinese-speaking threat actor TA4922 is utilizing PackClient, a modular C2 framework sold on Telegram, to target organizations in China and India with tax-themed phishing lures.
The Dark Caracal threat actor is deploying a modular Go-based framework named GoCaracal that utilizes Ethereum smart contracts for resilient command-and-control infrastructure.
