Browse public community intelligence reports, source analysis, and threat research.
4 intel reports
The Kim Sooki threat actor utilizes the Syslogk Linux rootkit to achieve persistence and concealment by hooking kernel APIs to hide processes, network connections, and files.
ACRStealer campaign leverages a legitimate, Microsoft-signed Korean DLP driver (DCRCVDrv.sys) to perform kernel-context process termination for security software suppression.
The 1337_GTWK Linux malware campaign utilizes a sophisticated two-stage infection chain featuring a kernel rootkit and a user-space Go agent to establish persistent control and evade detection.
TeamPCP and other actors are leveraging container escapes via host vulnerabilities (CVE-2024-21626) and misconfigured orchestration APIs to compromise Kubernetes secrets and host systems.
