Browse public community intelligence reports, source analysis, and threat research.
157 intel reports
The threat actor zdn2pwn utilizes XHOPELESS v1.0, a sophisticated multi-phase wiper designed to permanently brick Windows systems by corrupting UEFI firmware, destroying disk partitions, and disabling all recovery mechanisms.
A suspected Chinese-speaking threat actor is targeting systems in South Korea to install remote control and proxy tools, including Radmin, UltraVNC, and SoftEther VPN, to weaponize infected hosts as proxy nodes.
Russian-linked threat actor UAT-10820 utilizes ClearFake infection chains and WebDAV-hosted DLLs to deploy Amatera stealer and follow-on payloads like ZigCryptoStealer and NetSupport Manager.
Threat actors are exploiting ScreenConnect to deploy a four-stage VBScript chain that propagates across active remote sessions, ultimately delivering miners and backdoors.
Threat actors are leveraging compromised WordPress sites and blockchain smart contracts to deliver Amatera password stealers and WebRTC stagers through ClickFix lures.
A Russian-speaking operator compromised over 14,000 Dahua IP cameras globally, primarily in Ukraine and Russia, using authentication bypasses, P2P relay abuse, and credential brute-forcing.
Stealer/1.0 is a hybrid malware designed to exfiltrate cloud, browser, and developer credentials via Discord webhooks before executing a highly destructive wiper routine that formats the C: drive.
Auto-Color is a Linux backdoor that uses a double-forking mechanism and an LD_PRELOAD-based rootkit (libcext.so.2) to hide files and network activity while communicating with a C2 server at 146.70.41.178.
BREEZE COMET targets Brazilian financial services and payment systems like Pix using a custom multi-language malware suite and AI-accelerated tradecraft.
An unattributed threat cluster with similarities to SilverFox is targeting Cambodian organizations using a multi-stage infection chain that leverages BYOVD techniques and PNG-based shellcode to deploy SparkRAT.
