Browse public community intelligence reports, source analysis, and threat research.
82 intel reports
China-based Jewelbug APT utilizes the XG-Web platform to conduct dual-mission operations involving government espionage across the Middle East and Asia alongside large-scale cryptocurrency fraud.
HoneyMyte (Mustang Panda) has updated the CoolClient backdoor with a signed kernel-mode rootkit, msagent.sys, to hide and protect malicious artifacts on Windows systems.
Outsider Enterprise utilizes the JWR phishing framework, a variant of The Outsider, to perform real-time credential and PII theft through SMS lures and encrypted WebSockets.
Gray-market services like Poison Claude and Ecomagent exploit cloud promotional credits and synthetic identities to resell discounted, proxied access to frontier AI models.
The threat actor Storm-2755, also known as Payroll Pirates, uses adversary-in-the-middle (AiTM) phishing and residential proxies to compromise Microsoft 365 accounts for targeted financial data collection.
The financially motivated threat actor Woodgnat is deploying the stealthy Backdoor.Mistic via DLL side-loading to facilitate ransomware access for affiliates.
Storm-2755 (Payroll Pirates) uses AiTM phishing and residential proxies to compromise Microsoft 365 accounts for financial data theft and payroll diversion.
Myxa VPN operates 737 malicious Chrome extensions impersonating 66 privacy brands to redirect all user browser traffic through controlled SOCKS5 proxies.
UNC6671 and associated clusters utilize sophisticated vishing and AiTM panels to harvest credentials and exfiltrate data from enterprise cloud and financial platforms.
Forest Blizzard (linked to Russian military intelligence) compromises SOHO routers to perform DNS hijacking and adversary-in-the-middle attacks targeting Microsoft 365 and government servers.
