Browse public community intelligence reports, source analysis, and threat research.
23 intel reports
A China-linked actor is using the advanced Daxin kernel-mode rootkit alongside a novel Stupig backdoor to maintain decade-long persistence in a Taiwan manufacturing firm.
The Chinese cybercrime subgroup CylindricalCanine, part of GoldenEyeDog, targets financial organizations and certificate providers using a modified Gh0st RAT and sophisticated code-signing certificate theft.
A Vidar malware-as-a-service affiliate is targeting SMBs with a dual-payload infection of the Vidar infostealer and XMRig miner delivered via malicious software cracks.
The Shai-Hulud worm and GitRunner C2 framework abuse legitimate, digitally signed GitLab CI runner binaries as persistent backdoors to execute commands via CI/CD pipelines.
The Gentlemen Ransomware-as-a-Service (RaaS) group utilizes a sophisticated EDR-killing framework and targets global organizations using leaked Fortinet VPN credentials.
A Russian-speaking attacker is deploying the Meow AppleScript RAT via ClickFix social engineering lures to exfiltrate data and hijack cryptocurrency wallets on macOS.
OceanLotus (APT32) is leveraging SPECTRALVIPER in targeted supply-chain attacks against Vietnamese stock investors and infrastructure corporations to support domestic surveillance.
IRGC-affiliated actor Nimbus Manticore deployed the new MiniFast backdoor using AppDomain hijacking and SEO poisoning to target both aviation and software sectors during geopolitical conflict.
The CL-CRI-1089 threat actor is conducting malvertising campaigns targeting macOS users to deploy FlutterShell, a Flutter-based backdoor that facilitates browser hijacking and arbitrary command execution.
Fox Tempest operates a malware-signing-as-a-service (MSaaS) operation that abuses Microsoft Artifact Signing to help ransomware affiliates and malware operators evade security controls.
