Browse public community intelligence reports, source analysis, and threat research.
101 intel reports
Russian state actor Star Blizzard is conducting large-scale phishing campaigns against Ukraine-aligned organizations using a novel malware delivery technique called RedFlick to deploy the CosmicPulse backdoor.
German law enforcement and suspected state actors are bypassing end-to-end encryption by leveraging linked-device features to clone messenger accounts on WhatsApp, Signal, and Telegram.
An attacker-controlled ScreenConnect client is being distributed via phishing emails as a legitimate, signed executable to gain remote access to victim systems.
The CSuite operation targets US and European organizations using sophisticated phishing lures to steal Microsoft 365 sessions and deploy legitimate RMM tools like ScreenConnect for persistent endpoint access.
SilverFox actors are targeting Malaysian users via WhatsApp lures that deliver ValleyRAT using DLL side-loading of a signed KuGou Technology executable.
Water Hydra (EvilNum) has transitioned from complex zero-day exploits to social engineering-driven campaigns using .PIF files and non-standard protocol handlers to deliver the DarkMe RAT.
Sauron Loader is a novel Russian-language Malware-as-a-Service that utilizes social engineering, DLL side-loading, and in-memory decryption to deliver multi-stage payloads.
Threat actors utilized fraudulent Google Ads and dynamic Vercel redirects to target Ledger hardware wallet users, aiming to steal secret recovery phrases through a sophisticated phishing chain.
The Rapuncel infostealer is distributed via SEO-optimized fake GitHub organizations, utilizing a Microsoft-signed kernel driver to disable security software.
Storm-2992 operates EvilTokens, an AI-driven Phishing-as-a-Service platform targeting Microsoft 365 through device code authentication abuse to facilitate business email compromise.
