Browse public community intelligence reports, source analysis, and threat research.
120 intel reports
APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.
Attackers are abusing Microsoft Power BI dashboards to host malicious links that deliver redundant ScreenConnect RMM installers for persistent remote access.
An extensive phishing campaign impersonating the U.S. District Court targets over 100,000 companies using personalized lures to deliver the LodaRAT remote access trojan via malicious ISO files.
Storm-3119 (YAM Store) acts as a power broker selling compromised Microsoft 365 and Google infrastructure to Storm-2990, who develops and operates global Phishing-as-a-Service (PaaS) kits.
Unknown threat actors compromised ConnectWise Cloud Backup application identities to gain unauthorized access to Microsoft 365 tenants across multiple sectors.
SkyW4lker is a device-code phishing kit targeting Microsoft 365 users, primarily in the US technology and manufacturing sectors, to bypass MFA and obtain access tokens.
The threat actor UNG0002 is targeting academic institutions using macOS-style metadata folder structures to evade Windows security scanners and deliver Cobalt Strike via DLL sideloading.
The Lazarus Group is targeting South Korean sectors by exploiting mandatory financial security software to deploy a sophisticated malware framework featuring post-quantum encryption.
Threat actors are abusing legitimate Microsoft Power BI domains to host phishing lures that deliver multiple rogue ScreenConnect instances for persistent remote access.
Midnight Blizzard-linked actor GTG-20006 utilized AI-assisted code generation to modify PowerShell stagers and Go backdoors targeting government and defense organizations via device-code phishing.
