Browse public community intelligence reports, source analysis, and threat research.
39 intel reports
A campaign involving hijacked npm and Go packages uses malicious VS Code tasks to trigger a multi-stage infection chain involving blockchain dead drops, a socket.io backdoor, and a Python infostealer.
An unidentified threat actor is targeting Thailand's healthcare sector using healthcare-themed lures to deploy a Python-based information stealer via multi-stage batch scripts.
The China-aligned APT group Webworm has shifted focus to European government entities using new backdoors EchoCreep and GraphWorm along with custom proxy tools.
The KongTuke group is leveraging Microsoft Teams social engineering to deploy ModeloRAT, escalate privileges via CVE-2023-36036, and harvest domain credentials using fake Windows lock screens.
Seedworm (MuddyWater) conducted a global espionage campaign in early 2026 using Node.js loaders and DLL sideloading to target manufacturing, government, and financial sectors.
UNC5142 utilizes EtherRAT and the AI-generated TukTuk framework to conduct data exfiltration and deploy The Gentlemen ransomware via decentralized and SaaS infrastructure.
The threat actor Mr_Rot13 is exploiting a critical cPanel authentication bypass (CVE-2026-41940) to deploy Go-based infectors and the 'filemanager' remote access trojan.
Threat actor Dr. Tube uses the Bissa Scanner and AI tools like Claude Code to exploit React2Shell vulnerabilities at scale, targeting financial and crypto sectors for secret harvesting.
Threat actors including GOLD ENCOUNTER and campaigns STAC4713/STAC3725 are abusing QEMU virtualization to hide backdoors and deploy PayoutsKing and 3AM ransomware.
