Browse public community intelligence reports, source analysis, and threat research.
157 intel reports
PIVOTPIPE is a newly discovered .NET malware that reimplements Cobalt Strike Beacon features with custom evasion techniques, including AMSI bypassing and indirect syscalls.
KATARU is a newly observed IoT malware family that utilizes Linux local privilege escalation exploits and encrypted C2 to conduct DDoS attacks.
Russia-aligned threat actor UAC-0099 is using the GuardBreaker technique to trip AI safety guardrails and blind automated malware analysis tools targeting Ukrainian critical infrastructure.
Cluster c05d5254 utilizes the PoisonedRefresh rootkit to inject fileless PHP web shells into F5 BIG-IP APM memory via CVE-2025-53521 exploitation.
CRPx0 is a sophisticated cross-platform ransomware-as-a-service operation using ClickFix social engineering lures to deliver multi-stage Python-based payloads via clipboard hijacking.
REVSTEALER is a comprehensive Windows infostealer using Polygon smart contracts for resilient C2 infrastructure and delivering specialized modules for crypto-mining and reverse proxying.
State-sponsored and crimeware actors are actively exploiting Cisco Secure Firewall Management Center vulnerabilities to deploy Cyclops Blink, Qilin ransomware, and custom web shells.
Suspected Silver Fox (Yinhu) threat actors are targeting Chinese-speaking users and multinational operations in China using high-fidelity spoofed vendor sites to deliver persistent implants like ValleyRAT.
The CL-CRI-1171 threat actor operates a mature Pay-Per-Install (PPI) marketplace that leverages SEO poisoning and trojanized YouTube gaming content to distribute OfferLoader and a variety of secondary payloads including Insomnia RAT and ARKTunnel.
BlackSuit ransomware operators conducted a 9-day intrusion starting with VPN brute-force attacks on non-MFA accounts, followed by lateral movement via RDP and data staging before enterprise-wide encryption.
