Browse public community intelligence reports, source analysis, and threat research.
157 intel reports
Analysis of six bypass techniques targeting the Windows Anti-Malware Scan Interface (AMSI) in PowerShell 5.1 and 7 using reflection, memory patching, and IL emission.
Threat actors are exploiting an unauthenticated remote code execution vulnerability in Langflow (CVE-2026-33017) to deploy a multi-stage Monero cryptomining toolchain and spread via SSH key reuse.
The EDRChoker tool weaponizes Windows Policy-based Quality of Service (QoS) to throttle EDR process bandwidth to 8 bits per second, effectively isolating them from their management servers.
SilverFox actors are utilizing a multi-stage loader chain masquerading as Panasonic and Philips software to deploy Sauron/Gh0stRAT backdoors via Alibaba OSS infrastructure.
An unidentified threat actor used ClickFix social engineering to deploy Potemkin Loader and RMMProject, moving laterally via SMBExec to distribute EtherRAT across 11 hosts.
The Gentlemen Ransomware-as-a-Service (RaaS) group utilizes a sophisticated EDR-killing framework and targets global organizations using leaked Fortinet VPN credentials.
UNC6508, a PRC-nexus threat actor, targets medical and military research institutions using INFINITERED malware to harvest credentials and exfiltrate data via manipulated compliance rules.
Dropping Elephant is using a China-themed decoy document to deliver a heavily reworked, in-memory RAT via DLL side-loading and Donut shellcode.
Attacker sergey2016 compromised the @mastra npm organization to inject the easy-day-js typosquat dependency, delivering an obfuscated postinstall dropper.
The Gentlemen ransomware, operated by the Phantom Mantis group (LARVA-368), has evolved from a RaaS affiliate into an independent operation featuring AI-assisted development and a self-propagating worm module.
