Browse public community intelligence reports, source analysis, and threat research.
23 intel reports
The AnyDesk TAG campaign uses cloned banking support sites and telephone-led social engineering to deploy AnyDesk and persistent ScreenConnect instances via malicious signed payloads and DLL side-loading.
Suspected TraderTraitor group targets developers using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware via lookalike domains and GitHub.
The suspected TraderTraitor group is using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware for credential theft and persistent access.
The CSuite operation targets US and European organizations using sophisticated phishing lures to steal Microsoft 365 sessions and deploy legitimate RMM tools like ScreenConnect for persistent endpoint access.
The Rapuncel infostealer is distributed via SEO-optimized fake GitHub organizations, utilizing a Microsoft-signed kernel driver to disable security software.
The Iranopasmigirim campaign by an Iran-linked actor uses DLL sideloading to deploy ParsaStealer, a Rust-based infostealer targeting dissidents via lures mimicking the Rise Iran movement.
An adversary uses malicious Google Apps Scripts in Google Doc sidebars to deliver AMOS and NetSupport Manager malware targeting both macOS and Windows users.
ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.
AmnesiaStealer is a multi-stage Rust-based macOS infostealer that uses ClickFix lures and a remote streaming module to gain live, hidden control of Chromium browsers.
The SMOKE#SCREEN campaign utilizes diverse social engineering lures and aggressive security-dismantling toolsets to deploy persistent ScreenConnect RMM agents on Windows and macOS systems.
