Browse public community intelligence reports, source analysis, and threat research.
157 intel reports
SilverFox APT is targeting users with fake Microsoft Teams download sites to deliver ValleyRAT through a multi-stage DLL sideloading chain and in-memory execution.
Fox Tempest operates a malware-signing-as-a-service (MSaaS) operation that abuses Microsoft Artifact Signing to help ransomware affiliates and malware operators evade security controls.
The PoisonX threat actor utilizes a complex multi-stage attack chain involving DLL sideloading and vulnerable driver exploitation (BYOVD) to deploy a modular RAT with EDR-bypass capabilities.
The threat actor Storm-2949 leverages social engineering and SSPR abuse to compromise identities, pivoting to Azure control-plane operations for massive data exfiltration.
CountLoader uses multi-stage PowerShell and JavaScript execution via mshta.exe to deploy a cryptocurrency clipper that redirects transactions by hijacking clipboard data.
The InstallFix campaign utilizes Google Ads and fake Claude AI installation pages to deliver RedLine Stealer through a complex, multi-stage infection chain.
The Nightmare-Eclipse toolset, including BlueHammer and RedSun, was observed in a live intrusion following initial access via compromised FortiGate VPN credentials.
Deep#Door is a sophisticated Python-based Remote Access Trojan (RAT) that uses self-referential batch scripts for deployment and leverages the bore[.]pub tunneling service for stealthy C2 communications.
The Kyber ransomware group deploys specialized dual-platform payloads targeting VMware ESXi infrastructure and Windows file systems, utilizing hybrid encryption and extensive anti-recovery techniques.
The Gentlemen RaaS employs a multi-platform locker suite targeting Windows, Linux, and ESXi environments, utilizing SystemBC and Cobalt Strike for lateral movement and persistence.
