Browse public community intelligence reports, source analysis, and threat research.
120 intel reports
EvilTokens and other phishing frameworks are increasingly abusing the Microsoft Device Code Flow to bypass MFA and conduct Business Email Compromise (BEC) at scale.
The Silver Fox threat actor targets Japanese and Chinese organizations using spear-phishing to deploy the modular 10FXRAT and the PoisonX kernel driver for security product bypass.
The suspected Chinese threat actor TA4922 is expanding globally, utilizing new loaders like RomulusLoader and SilentRunLoader alongside Atlas RAT to target organizations in Asia and Europe.
The Iran-nexus group Screening Serpens is targeting technology, aerospace, and defense professionals in the US, Israel, and UAE using advanced AppDomainManager hijacking and new RAT variants.
The TAX#TRIDENT campaign utilizes fake Indian income tax assessment lures to deliver YTSCRat or unauthorized ManageEngine UEMS agents through various VBScript and ZIP-based infection paths.
The threat actor Storm-2949 leverages social engineering and SSPR abuse to compromise identities, pivoting to Azure control-plane operations for massive data exfiltration.
The InstallFix campaign utilizes Google Ads and fake Claude AI installation pages to deliver RedLine Stealer through a complex, multi-stage infection chain.
Silver Fox threat group utilizes tax-themed phishing to deploy a modified RustSL loader, ValleyRAT, and a new Python-based backdoor named ABCDoor against organizations in Russia and India.
JanelaRAT is an evolving variant of BX RAT targeting financial and cryptocurrency institutions in Latin America through DLL side-loading and sophisticated overlay attacks.
The Kimsuky threat group is distributing complex Python-based backdoors and downloaders via multi-stage LNK files using scheduled tasks for persistence.
