Browse public community intelligence reports, source analysis, and threat research.
8 intel reports
KGB RAT is a Windows-based Malware-as-a-Service (MaaS) tool providing Remote Access Trojan capabilities, including credential theft, HVNC, ransomware, and cryptocurrency wallet swapping.
Russian-speaking actors NyashTeam and Kapchenka operate Salat Stealer (WEB_RAT), a Go-based MaaS targeting Windows for credential and cryptocurrency theft.
CrocoRat is a Python-based remote access trojan and cryptocurrency stealer delivered via ClickFix social engineering and novel DNS TXT record payload staging.
Midnight Blizzard-linked actor GTG-20006 utilized AI-assisted code generation to modify PowerShell stagers and Go backdoors targeting government and defense organizations via device-code phishing.
The ClickFix EtherHiding campaign leverages compromised WordPress sites to deliver malware by retrieving stage-two payloads from Ethereum smart contracts.
Threat actors are utilizing fake software updates and gaming cheats to deploy ScreenConnect RMM agents and the Powercat Java stealer for persistent access and credential theft.
The ToddyCat APT group utilizes Umbrij malware to compromise corporate Gmail accounts by leveraging a technique called Shadow Token via Remote Debug (STRD) to steal OAuth tokens.
DarkWatchman is a sophisticated, fileless JavaScript-based RAT that uses C# keyloggers and registry-based persistence to evade detection.
