Browse public community intelligence reports, source analysis, and threat research.
5 intel reports
A compromised version of the Tensorlake npm package (v0.5.144) distributes the Shai-Hulud worm to steal developer credentials and crypto-wallets while utilizing Ethereum smart contracts for C2 agility.
DPRK cyber operations serve as an 'all-purpose sword' for revenue generation, espionage, and sanctions evasion through a complex hierarchy of state agencies and IT worker units.
ToxNetV2 is an AArch64 Linux P2P botnet that integrates NVIDIA NIM LLM services into its controller's decision-making loop to propose operational actions.
A likely Iran-nexus activity cluster is deploying BLUERABBIT, a Golang-based backdoor that utilizes RabbitMQ, Redis, and MinIO for C2 and exfiltration prior to disk wiping and ransomware deployment.
The Russia-aligned actor Pawn Storm (APT28) is deploying the PRISMEX malware suite via zero-day exploits and advanced steganography to target the Ukrainian defense supply chain and NATO logistics hubs.
