Browse public community intelligence reports, source analysis, and threat research.
62 intel reports
UNC5221 utilizes the SNOWLIGHT dropper to deploy VSHELL RAT, employing sophisticated evasion like direct syscalls and AMSI patching to compromise Windows systems.
Liushen is a Python-based ransomware framework that utilizes process hollowing, MBR modification, and extensive anti-analysis techniques to encrypt victim data and inhibit recovery.
The Yuta/Solara campaign distributes a Python-based port of Glove Stealer targeting Roblox users and developers with advanced Chrome App-Bound Encryption bypasses.
The Weedhack Malware-as-a-Service (MaaS) campaign targets Minecraft players with custom JAR files that deploy multi-stage infostealers and RATs using Ethereum-based C2 infrastructure.
SilentCryptoMiner and XMRig variants are being distributed through pirated movie and digital library sites using fake video player updates and DLL side-loading.
Cloud Atlas APT targets government and diplomatic entities in Russia and Belarus using a revamped toolset including VBCloud, PowerShower, and the new PowerCloud data exfiltration script.
The TAX#TRIDENT campaign utilizes fake Indian income tax assessment lures to deliver YTSCRat or unauthorized ManageEngine UEMS agents through various VBScript and ZIP-based infection paths.
The threat actor STAC6405 is conducting an ongoing phishing campaign targeting U.S. organizations with a dual-RMM architecture using SimpleHelp and ScreenConnect for persistent, silent access.
BlueNoroff is targeting Web3 and cryptocurrency executives using AI-generated deepfake meetings and ClickFix clipboard injection to deploy credential stealers.
An attacker uses a multi-stage fileless infection chain involving obfuscated VBScript and in-memory .NET loaders to deploy ScreenConnect for persistent remote access.
