Browse public community intelligence reports, source analysis, and threat research.
17 intel reports
Suspected TraderTraitor group targets developers using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware via lookalike domains and GitHub.
The suspected TraderTraitor group is using trojanized Terraform providers to deliver cross-platform FLATROOF and ROOFDECK malware for credential theft and persistent access.
The Rapuncel infostealer is distributed via SEO-optimized fake GitHub organizations, utilizing a Microsoft-signed kernel driver to disable security software.
The Iranopasmigirim campaign by an Iran-linked actor uses DLL sideloading to deploy ParsaStealer, a Rust-based infostealer targeting dissidents via lures mimicking the Rise Iran movement.
REVSTEALER is a comprehensive Windows infostealer using Polygon smart contracts for resilient C2 infrastructure and delivering specialized modules for crypto-mining and reverse proxying.
The cyber criminal group TeamPCP is conducting large-scale software supply chain attacks targeting DevOps and security tools to exfiltrate cloud credentials and secrets.
Adversaries are globally leveraging the ClickFix social engineering technique to trick Windows and macOS users into executing malicious terminal commands that deliver infostealers and RATs.
The WhiteCobra threat actor is deploying malicious 'Solidity Pro' VS Code extensions that evolve from Cloudflare-hosted Python droppers to comprehensive credential and wallet infostealers.
A new Windows infostealer called Dolphin X, sold by the actor Kontraktnik, uses AI-driven triage to prioritize high-value corporate and DevOps targets.
Adversaries utilize various AWS-native features including IAM users, cross-account roles, Lambda backdoors, and federated sessions to maintain long-term persistence in victim cloud environments.
