Browse public community intelligence reports, source analysis, and threat research.
157 intel reports
Threat actors are increasingly using LLMs to generate bespoke, functional malware and automate complex Active Directory enumeration, data exfiltration, and extortion workflows.
Russian-speaking threat actor UAT-11795 is utilizing ClickFix lures and trojanized software to deploy novel Python-based Starland RAT and PowerShell-based WLDR agent for cryptocurrency theft.
An unknown threat actor deployed a new Rust-based ransomware called Spirals against a South Asian IT services company using web shell access and rapid lateral movement.
Salat Stealer, a Go-based information stealer, is distributed via gaming utilities like Xeno Executor to harvest credentials, crypto wallets, and perform live surveillance.
An unknown Chinese-speaking APT group is targeting Russian critical sectors by exploiting the ViPNet update system to deploy a suite of malicious modules including HelloInjector and HelloProxy.
The threat actor Hyadina has rebranded Beast ransomware as GodDamn, utilizing the malicious PoisonX kernel driver to disable endpoint defenses via BYOVD attacks.
A logistics-themed spear-phishing campaign deploys CrySome RAT via a multi-stage chain involving UAC bypass, AMSI patching, and the WinDefCtl utility to disable endpoint defenses.
Everest is a Russian-speaking ransomware group utilizing a triple-stream business model including file encryption, initial access brokerage, and paid corporate insider recruitment.
The Hyadina threat group is deploying the rebranded GodDamn ransomware, utilizing a Microsoft-signed PoisonX kernel driver to disable EDR and antivirus software.
A financially motivated campaign by the X3D MINER group uses the Factory-v3 loader framework to deliver Vidar stealer and XMRig miner through malvertising and fake software cracks.
