Browse public community intelligence reports, source analysis, and threat research.
23 intel reports
VulcanRAT207.B leverages RomulusLoader and signed VulkanInfo binaries to establish persistent remote access and kernel-level evasion on Windows systems.
An unidentified threat actor utilizes renamed Python interpreters and custom ._pth files to execute malicious code without command-line arguments, eventually attempting to deploy ScreenConnect via a UAC bypass.
Star Blizzard (suspected Russian state-linked) is conducting spearphishing campaigns against Moldovan and Ukrainian civil society using password-protected VHDX files and WebDAV-based persistence.
Gryxa is a highly persistent, AI-developed toolkit used by financially motivated actors to steal credentials and maintain durable access via extensive recovery mechanisms.
Suspected Star Blizzard threat actors target Moldovan and Ukrainian civil society using the RedFlick technique, involving conversation-based phishing and VHDX-delivered malware.
BabylonRAT is an open-source Remote Access Trojan (RAT) capable of credential theft, keylogging, and DDoS attacks, recently used in campaigns targeting public institutions in Malaysia.
The Kim Sooki threat actor utilizes the Syslogk Linux rootkit to achieve persistence and concealment by hooking kernel APIs to hide processes, network connections, and files.
APT28 and MuddyWater utilize ClickFix variants to compromise organizations via social engineering, deploying multi-stage payloads including steganography and Python-based reverse tunnels for internal network pivoting.
Lazarus Group is targeting macOS users with trojanized application installers that deliver the OtterCookie RAT through a multi-stage infection chain.
The threat actor STAC4749 uses Microsoft Teams vishing to impersonate IT support, gaining remote access to deploy custom loaders, backdoors, and Chaos ransomware targeting North American organizations.
