Browse public community intelligence reports, source analysis, and threat research.
157 intel reports
The EDRChoker tool abuses Windows Policy-Based Quality of Service (QoS) to starve security agents of bandwidth, causing them to silently time out without generating network block artifacts.
TeamPCP uses the Miasma worm to compromise developers and CI/CD pipelines by hijacking AI coding agents and poisoning package registries.
LCRYX is a multifunctional VBS-based ransomware and worm that performs extensive registry tampering, security software termination, and network-wide self-propagation.
The Reynolds ransomware group utilizes the NSecKrnl kernel driver to terminate EDR processes and employs double-extortion tactics against enterprise targets.
Play Ransomware Group's custom Grixba infostealer has evolved from a monolithic tool to a modular, evasive scanner frequently deployed by DPRK-linked initial access brokers.
A multi-stage HTA-based loader uses VBScript and PowerShell to deploy the Lightlife RAT, targeting crypto wallets and establishing persistence via Russian infrastructure.
DRAYN is a sophisticated multi-stage stealer and loader malware that utilizes 7-Zip SFX archives for deployment and maintains persistent C2 via WebSockets.
UNC5221 utilizes the SNOWLIGHT dropper to deploy VSHELL RAT, employing sophisticated evasion like direct syscalls and AMSI patching to compromise Windows systems.
Liushen is a Python-based ransomware framework that utilizes process hollowing, MBR modification, and extensive anti-analysis techniques to encrypt victim data and inhibit recovery.
The UNK_DeadDrop threat actor targets developers with fake recruitment and code review phishing campaigns to deploy cross-platform malware for cryptocurrency theft.
