Intel Exchange

Lazarus Group's Famous Chollima unit utilizes stolen identities and AI-assisted workflows to infiltrate Western finance and technology firms as remote IT workers.

Direwolf is an emerging ransomware group using custom Golang-based malware and double-extortion tactics to target global organizations, particularly in the manufacturing and technology sectors.

The Manic Android malware family targets financial and government services, utilizing unique Wi-Fi and Bluetooth mesh networks to exfiltrate data from offline devices.

PurpleDelta, a North Korean IT worker group, uses AI-generated personas and identity brokering to secure remote technical roles for revenue generation and potential supply-chain compromise.

Outsider Enterprise utilizes the JWR phishing framework, a variant of The Outsider, to perform real-time credential and PII theft through SMS lures and encrypted WebSockets.

The threat actor Storm-2755, also known as Payroll Pirates, uses adversary-in-the-middle (AiTM) phishing and residential proxies to compromise Microsoft 365 accounts for targeted financial data collection.

A threat group named Motions Vics is conducting a global banking phishing campaign using Telegram bots for credential exfiltration and AnyDesk for remote access.

UNC6780 and MIDNIGHT NEPTUNE target open-source repositories and AI coding environments to deploy credential stealers and backdoors via malicious package dependencies.

The SMOKE#SCREEN campaign utilizes diverse social engineering lures and aggressive security-dismantling toolsets to deploy persistent ScreenConnect RMM agents on Windows and macOS systems.

UNC6692 uses email bombing and IT impersonation via Microsoft Teams to deploy the Edgecution/SNOW malware suite and facilitate ransomware access.