Intel Exchange

The AnyDesk TAG campaign uses cloned banking support sites and telephone-led social engineering to deploy AnyDesk and persistent ScreenConnect instances via malicious signed payloads and DLL side-loading.

Unauthorized AI relay services are reconfiguring legitimate OpenAI and Anthropic CLI tools to bypass regional restrictions, disabling sandboxes and routing data through third-party infrastructure.

The threat actor UNG0002 is targeting academic institutions using macOS-style metadata folder structures to evade Windows security scanners and deliver Cobalt Strike via DLL sideloading.

DarkCore is a remote access trojan (RAT) that uses a dedicated browser to reuse stolen sessions and route traffic through victims' IP addresses to bypass MFA and security controls.

Adversary c05d5254 uses the PoisonedRefresh rootkit to inject fileless PHP web shells into F5 BIG-IP APM memory via CVE-2025-53521 exploitation.

Gryxa is a highly persistent, AI-developed toolkit used by financially motivated actors to steal credentials and maintain durable access via extensive recovery mechanisms.

Akira ransomware targets global organizations across Windows and Linux platforms using double extortion, vulnerability exploitation, and credential theft.

Play (or Playcrypt) is a sophisticated ransomware group utilizing double extortion, custom information stealers like Grixba, and exploitation of vulnerabilities in FortiOS and Microsoft Exchange to target global organizations.

Weedhack malware is distributed to gamers through SEO-poisoned lookalike websites impersonating popular Minecraft clients and mods.

Akira ransomware affiliates utilize RDP for initial access, ProcDump for credential theft, and GOST tunnels for persistence before deploying Rclone for exfiltration and encrypting data.