Browse public community intelligence reports, source analysis, and threat research.
184 intel reports
The Iran-linked threat actor Handala Hack uses the HEAVYGRAM Telegram-based backdoor and CRUDEEXCLUDE utility to target dissidents and journalists for surveillance and data exfiltration.
State-sponsored and criminal actors are increasingly using AI as an engineering workforce to automate exploit development, surveillance, and multi-victim cyber campaigns.
The TeamPCP threat group utilized backdoored TanStack npm packages to harvest credentials from a former CrowdSec employee, leading to the theft of 170 private GitHub repositories.
BabylonRAT is an open-source Remote Access Trojan (RAT) capable of credential theft, keylogging, and DDoS attacks, recently used in campaigns targeting public institutions in Malaysia.
The REF9334 threat group utilizes the KREMLIN toolkit to install malicious browser extensions on Chrome and Edge, leveraging Ethereum smart contracts as dead-drop resolvers to target Brazilian banking users.
Casbaneiro banking trojan targets Latin American users via geofenced phishing and a multi-stage AutoIt infection chain to exfiltrate financial credentials.
Oldphantomoftheopera and Phantom Softwares operate Phantom Stealer, a Malware-as-a-Service infostealer targeting Windows systems through multi-stage in-memory execution and obfuscated PowerShell to harvest credentials and cryptocurrency data.
Threat actors are using fake Grand Theft Auto VI (GTA6) installers to distribute a multi-component malware package including RATs, infostealers, and a wiper.
Suspected state-sponsored actors and cybercriminals, including Midnight Blizzard and ShinyHunters, are utilizing generative AI frameworks like PentAGI to automate the cyber kill chain, reconnaissance, and malware development against global targets.
DPRK-nexus actors are using fake Web3 job interviews to deliver signed ClickOnce applications that deploy NeedleStealer, an unclassified Rust stealer, and a Go-based hVNC RAT.
